This vulnerability involves improper link resolution before file access in the virt-exportserver component of KubeVirt within Red Hat OpenShift Virtualization 4. An attacker with namespace-level privileges can exploit a path traversal flaw by placing a symbolic link in an exported filesystem PVC that references files outside the mount root. This enables unauthorized reading of arbitrary files on the exporter pod's filesystem, resulting in potential sensitive data exposure. The CVSS 3.1 base score is 7.7, indicating high severity with network attack vector, low attack complexity, and no user interaction required.

Successful exploitation allows an attacker with namespace-level access to read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data within the cluster environment. There is no indication of integrity or availability impact. No known exploits in the wild have been reported as of the publication date.

Patch status is not yet confirmed — check the Red Hat advisory at https://access.redhat.com/security/cve/CVE-2026-9804 for current remediation guidance. Until an official fix is available, restrict namespace-level permissions to trusted users only and monitor for suspicious activity related to PVC exports. Avoid placing untrusted symbolic links in exported Persistent Volume Claims.