This vulnerability involves improper link resolution before file access (CWE-59) in the virt-exportserver component of KubeVirt used in Red Hat Container Native Virtualization 4.17. An attacker who has namespace-level privileges can create symbolic links inside an exported filesystem Persistent Volume Claim (PVC) that point outside the designated mount root. When the VMExport directory endpoint processes these symlinks, it allows the attacker to read arbitrary files from the exporter pod's filesystem, resulting in information disclosure. The vulnerability is classified as high severity (CVSS 7.7) with network attack vector, low attack complexity, and privileges required at the namespace level. According to Red Hat security advisories RHSA-2026:27903 and RHSA-2026:27913, no patches or fixes have been released yet for this vulnerability in the affected product versions.

Successful exploitation allows an attacker with namespace-level access to read arbitrary files on the exporter pod's filesystem by leveraging symbolic links in exported PVCs. This leads to information disclosure with potentially high confidentiality impact. There is no impact on integrity or availability reported. The vulnerability requires network access and privileges at the namespace level, but no user interaction.

As per the Red Hat advisories RHSA-2026:27903 and RHSA-2026:27913, no official fix or patch has been released yet for this vulnerability in Red Hat Container Native Virtualization 4.17. Users should ensure all previously released errata are applied and monitor Red Hat advisories for updates. Until a fix is available, restrict namespace-level access to trusted users only and avoid exposing the VMExport directory endpoint to untrusted networks or users. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.