Virt-cdi-controller: unauthorized pvc cloning via dataimportcron

Summary

A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.

Timeline

1. Jan 26, 2026, 7:36 PM UTCCVE published
2. Jan 26, 2026, 9:01 PM UTCCISA SSVC assessment

   Exploitation: none · Automatable: no · Technical impact: partial

3. Jul 15, 2026, 1:27 AM UTCRecord last updated

Affected versions

• container-native-virtualization/aaq-controller-rhel9

  Version range not reported

• container-native-virtualization/aaq-operator-rhel9

  Version range not reported

• container-native-virtualization/aaq-server-rhel9

  Version range not reported

• container-native-virtualization/bridge-marker-rhel9

  Version range not reported

• container-native-virtualization/cluster-network-addons-operator-rhel9

  Version range not reported

• container-native-virtualization/cnv-containernetworking-plugins-rhel9

  Version range not reported

• container-native-virtualization/cnv-must-gather-rhel9

  Version range not reported

• container-native-virtualization/hco-bundle-registry-rhel9

  Version range not reported

• container-native-virtualization/hostpath-csi-driver-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-operator-rhel9

  Version range not reported

• container-native-virtualization/hostpath-provisioner-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-operator-rhel9

  Version range not reported

• container-native-virtualization/hyperconverged-cluster-webhook-rhel9

  Version range not reported

• container-native-virtualization/kubemacpool-rhel9

  Version range not reported

• container-native-virtualization/kubesecondarydns-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-api-lifecycle-automation-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-apiserver-proxy-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-common-instancetypes-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-console-plugin-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-dpdk-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ipam-controller-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-realtime-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-ssp-operator-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-storage-checkup-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9

  Version range not reported

• container-native-virtualization/kubevirt-template-validator-rhel9

  Version range not reported

• container-native-virtualization/libguestfs-tools-rhel9

  Version range not reported

• container-native-virtualization/multus-dynamic-networks-rhel9

  Version range not reported

• container-native-virtualization/ocp-virt-validation-checkup-rhel9

  Version range not reported

• container-native-virtualization/ovs-cni-plugin-rhel9

  Version range not reported

• container-native-virtualization/passt-network-binding-plugin-cni-rhel9

  Version range not reported

• container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9

  Version range not reported

• container-native-virtualization/pr-helper-rhel9

  Version range not reported

• container-native-virtualization/sidecar-shim-rhel9

  Version range not reported

• container-native-virtualization/virt-api-rhel9

  Version range not reported

• container-native-virtualization/virt-artifacts-server-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-apiserver-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-cloner-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-importer-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-operator-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-uploadserver-rhel9

  Version range not reported

• container-native-virtualization/virt-controller-rhel9

  Version range not reported

• container-native-virtualization/virt-exportproxy-rhel9

  Version range not reported

• container-native-virtualization/virt-exportserver-rhel9

  Version range not reported

• container-native-virtualization/virt-handler-rhel9

  Version range not reported

• container-native-virtualization/virtio-win-rhel9

  Version range not reported

• container-native-virtualization/virt-launcher-rhel9

  Version range not reported

• container-native-virtualization/virt-operator-rhel9

  Version range not reported

• container-native-virtualization/vm-console-proxy-rhel9

  Version range not reported

• container-native-virtualization/vm-network-latency-checkup-rhel9

  Version range not reported

• container-native-virtualization/wasp-agent-rhel9

  Version range not reported

• container-native-virtualization/virt-cdi-controller

  Version range not reported

References 3