Is CVE-2026-17527 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-17527 being exploited in the wild.

How severe is CVE-2026-17527?

High severity, with a CVSS score of 7.7, published 27 July 2026.

Which products and versions are affected?

Red Hat Red Hat OpenShift Virtualization 4 4; KubeVirt containerized-data-importer (CDI).

Is there a fix for CVE-2026-17527?

No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

How is CVE-2026-17527 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-17527?

Check whether you run KubeVirt Containerized Data Importer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-17527: KubeVirt CDI authorization bypass in view ClusterRole

CVE-2026-17527 · Severity: high · CVSS 7.7 · Published 2026-07-27

A security flaw in the KubeVirt Containerized Data Importer (CDI) allows users with limited, read-only access to copy sensitive data they should not be able to see. By exploiting an overly permissive configuration, an attacker with basic access to one part of the system can clone virtual machine disks or data volumes from anywhere in the cluster into their own controlled area. This bypasses standard security boundaries designed to keep different projects or departments isolated from one another.

Vendors: KubeVirt.

Quick answers

Is CVE-2026-17527 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-17527 being exploited in the wild.
How severe is CVE-2026-17527?: High severity, with a CVSS score of 7.7, published 27 July 2026.
Which products and versions are affected?: Red Hat Red Hat OpenShift Virtualization 4 4; KubeVirt containerized-data-importer (CDI).
Is there a fix for CVE-2026-17527?: No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
How is CVE-2026-17527 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-17527?: Check whether you run KubeVirt Containerized Data Importer. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the KubeVirt containerized-data-importer (CDI) where the 'cdi.kubevirt.io:view' ClusterRole, intended for read-only access, includes 'create' permissions for the 'datavolumes/source' subresource. CDI's authorization logic incorrectly treats this subresource permission as sufficient to authorize cloning any PersistentVolumeClaim (PVC) in the cluster, even if the user lacks access to the source namespace. An attacker with this 'view' role and 'edit' or 'admin' privileges in any single namespace can exfiltrate data from any PVC in the cluster by cloning it into their own namespace. This represents an authorization bypass (CWE-639) that violates namespace isolation.

Affected products

Red Hat Red Hat OpenShift Virtualization 4 4
KubeVirt containerized-data-importer (CDI)

Timeline

2026-07-27: disclosed
2026-07-27: advisory

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.