Red Hat Security Advisory: OpenShift Virtualization v4.20 Images

The vulnerability CVE-2026-17527 exists in the containerized-data-importer (CDI) used by Red Hat OpenShift Virtualization. The aggregated ClusterRole cdi.kubevirt.io:view, designed for read-only access, improperly includes a create permission on the datavolumes/source subresource. This permission allows users or service accounts with this role cluster-wide and write access to any namespace to clone the contents of any PVC in the cluster into a namespace they control. This bypasses namespace isolation and the intended read-only guarantee of the view role. The flaw is confirmed upstream in kubevirt/containerized-data-importer and affects all downstream consumers using CDI's default aggregated RBAC roles. It is distinct from the SSP operator's scoped permission pattern. The vulnerability is related to CWE-639 (Authorization Bypass Through User-Controlled Key).

An attacker with cluster-wide view role and write access to any namespace can exfiltrate data from any PVC in the cluster, bypassing namespace isolation and read-only access controls. This leads to unauthorized disclosure of potentially sensitive data stored in PVCs across namespaces. The integrity and availability of the system are not impacted, but confidentiality is severely compromised.

No official fix is currently available. Until a fix is released, cluster administrators should avoid granting the cdi.kubevirt.io:view role or the built-in Kubernetes view role cluster-wide via ClusterRoleBinding. Instead, use namespace-scoped RoleBindings. Administrators should audit existing role bindings to ensure that no identities have both view-equivalent access cluster-wide and write (edit/admin) access to any namespace, as this combination enables cross-namespace data exfiltration.