Executive brief
KubeVirt is a tool that allows Kubernetes to manage virtual machines alongside standard containers. A security flaw in its data export component allows an attacker with basic access to a project to trick the system into reading files they shouldn't see. This could lead to the theft of sensitive configuration files or credentials from the underlying server infrastructure.
Technical details
A path traversal vulnerability exists in the KubeVirt virt-exportserver component's VMExport directory endpoint. The root cause is the use of Go's http.FileServer(http.Dir(mountPoint)), which follows symbolic links by default. An attacker with namespace-level permissions can create a symbolic link within an exported filesystem Persistent Volume Claim (PVC) that points to locations outside the designated mount root. By then accessing the VMExport directory endpoint with a valid token, the attacker can retrieve arbitrary files from the exporter pod's filesystem. This specifically affects PVCs without the 'cdi.kubevirt.io/storage.contentType' annotation. A fix is available in the KubeVirt main branch and various Red Hat OpenShift Virtualization releases.
Affected products
- KubeVirt KubeVirt <= 1.9.0-beta.0
- Red Hat OpenShift Virtualization 4.17, 4.18, 4.19, 4.20, 4.21
Timeline
- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-06-22: patched: Red Hat released patches for OpenShift Virtualization