Path Traversal Vulnerability in KubeVirt's VMExport Component
CVE-2026-9804

7.7HIGH

Key Information:

Vendor: Red Hat
Status: Red Hat Container Native Virtualization 4.17; Red Hat Container Native Virtualization 4.18; Red Hat Container Native Virtualization 4.19; Red Hat Container Native Virtualization 4.20
Vendor: CVE Published:; 28 May 2026

What is CVE-2026-9804?

A security flaw exists in the KubeVirt 'virt-exportserver' component that allows an attacker with specific namespace-level access to exploit a path traversal vulnerability. By creating a symbolic link within the exported filesystem Persistent Volume Claim (PVC) that points to locations outside its designated mount root, an attacker can gain unauthorized access to arbitrary files within the exporter pod's filesystem. This could lead to the disclosure of sensitive information, potentially compromising system integrity and confidentiality.