CVE-2026-17527: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Container Native Virtualization 4.14
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.
AI Analysis
Technical Summary
The vulnerability arises because the CDI's DataVolume clone authorization accepts the create permission on the datavolumes/source subresource granted by the cdi.kubevirt.io:view ClusterRole as sufficient to authorize cloning any PVC the caller names, without requiring write access to the source namespace. Consequently, a user or service account with the view role cluster-wide and write access to any single namespace can exfiltrate data from any PVC in the cluster into a namespace they control, violating namespace isolation and read-only access expectations.
Potential Impact
An attacker with limited privileges (view role cluster-wide plus write access to any namespace) can bypass namespace isolation and the read-only constraints of the view role to clone and exfiltrate the contents of any PVC in the cluster. This leads to unauthorized disclosure of potentially sensitive data stored in PVCs across namespaces. The vulnerability does not impact integrity or availability but has a high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-17527 for current remediation guidance. Until a fix is available, restrict granting the cdi.kubevirt.io:view ClusterRole cluster-wide and limit write access to namespaces to trusted users only to reduce risk.
CVE-2026-17527: Authorization Bypass Through User-Controlled Key in Red Hat Red Hat Container Native Virtualization 4.14
Description
In containerized-data-importer (CDI), the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authorize cloning the contents of any PVC the caller can name, without requiring write access to the source namespace. A user or service account bound to the view role, commonly granted cluster-wide via ClusterRoleBinding, who also has ordinary write access (edit/admin) to any single namespace, can use this to exfiltrate the contents of any PVC in the cluster into a namespace they control, bypassing namespace isolation and the read-only guarantee of the view role.
CVSS v3.1
Score 7.7high
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability arises because the CDI's DataVolume clone authorization accepts the create permission on the datavolumes/source subresource granted by the cdi.kubevirt.io:view ClusterRole as sufficient to authorize cloning any PVC the caller names, without requiring write access to the source namespace. Consequently, a user or service account with the view role cluster-wide and write access to any single namespace can exfiltrate data from any PVC in the cluster into a namespace they control, violating namespace isolation and read-only access expectations.
Potential Impact
An attacker with limited privileges (view role cluster-wide plus write access to any namespace) can bypass namespace isolation and the read-only constraints of the view role to clone and exfiltrate the contents of any PVC in the cluster. This leads to unauthorized disclosure of potentially sensitive data stored in PVCs across namespaces. The vulnerability does not impact integrity or availability but has a high confidentiality impact.
Mitigation Recommendations
Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-17527 for current remediation guidance. Until a fix is available, restrict granting the cdi.kubevirt.io:view ClusterRole cluster-wide and limit write access to namespaces to trusted users only to reduce risk.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- redhat
- Date Reserved
- 2026-07-27T08:42:15.783Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-17527","vendor":"Red Hat"}]
Threat ID: 6a6731749c2644c7f8d9a56b
Added to database: 07/27/2026, 10:22:44 UTC
Last enriched: 07/30/2026, 01:04:11 UTC
Last updated: 09/10/2026, 17:00:20 UTC
Views: 108
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.