# CVE-2026-9804: KubeVirt path traversal in virt-exportserver via symlink escape

Source: https://junglewise.ai/threats/cve-2026-9804-kubevirt-path-traversal-in-virt-exportserver-via-symlink-escape  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-05-28. Updated: 2026-07-01  
License: CC BY 4.0 with a link back

CVE-2026-9804 · Severity: high · CVSS 7.7 · Published 2026-05-28

KubeVirt is a tool that allows Kubernetes to manage virtual machines alongside standard containers. A security flaw in its data export component allows an attacker with basic access to a project to trick the system into reading files they shouldn't see. This could lead to the theft of sensitive configuration files or credentials from the underlying server infrastructure.

Technologies: [kubevirt.io/kubevirt (Go)](https://junglewise.ai/threats/technologies/kubevirt-io-kubevirt), [KubeVirt](https://junglewise.ai/threats/technologies/kubevirt). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [KubeVirt](https://junglewise.ai/threats/vendors/kubevirt).

## Quick answers

**Is CVE-2026-9804 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-9804 being exploited in the wild.

**How severe is CVE-2026-9804?** High severity, with a CVSS score of 7.7, published 28 May 2026.

**Which products and versions are affected?** kubevirt.io/kubevirt (Go) <= 1.9.0-beta.0, SEMVER:introduced=0, SEMVER:introduced=0,last_affected=1.9.0-beta.0; KubeVirt <= 1.9.0-beta.0, unspecified.

**Is there a fix for CVE-2026-9804?** A patch was published on 2026-06-22: Red Hat released patches for OpenShift Virtualization Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-9804 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-9804?** Check whether you run kubevirt.io/kubevirt (Go) or KubeVirt at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A path traversal vulnerability exists in the KubeVirt virt-exportserver component's VMExport directory endpoint. The root cause is the use of Go's http.FileServer(http.Dir(mountPoint)), which follows symbolic links by default. An attacker with namespace-level permissions can create a symbolic link within an exported filesystem Persistent Volume Claim (PVC) that points to locations outside the designated mount root. By then accessing the VMExport directory endpoint with a valid token, the attacker can retrieve arbitrary files from the exporter pod's filesystem. This specifically affects PVCs without the 'cdi.kubevirt.io/storage.contentType' annotation. A fix is available in the KubeVirt main branch and various Red Hat OpenShift Virtualization releases.

## Affected products

- KubeVirt KubeVirt <= 1.9.0-beta.0
- Red Hat OpenShift Virtualization 4.17, 4.18, 4.19, 4.20, 4.21

## Identifiers

- CVE-2026-9804
- GHSA-mpmf-3w4r-qfpf
- GO-2026-5883

## Timeline

- 2026-05-28: disclosed
- 2026-05-28: advisory
- 2026-06-22: patched: Red Hat released patches for OpenShift Virtualization

## References

- [https://access.redhat.com/security/cve/CVE-2026-9804](https://access.redhat.com/security/cve/CVE-2026-9804)
- [https://bugzilla.redhat.com/show_bug.cgi?id=2482487](https://bugzilla.redhat.com/show_bug.cgi?id=2482487)
- [https://access.redhat.com/errata/RHSA-2026:27914](https://access.redhat.com/errata/RHSA-2026:27914)
- [https://access.redhat.com/errata/RHSA-2026:27983](https://access.redhat.com/errata/RHSA-2026:27983)
- [https://access.redhat.com/errata/RHSA-2026:28002](https://access.redhat.com/errata/RHSA-2026:28002)

## Related threats

- [KubeVirt improper input validation in network annotation generator](https://junglewise.ai/threats/cve-2026-13434-kubevirt-improper-input-validation-in-network-annotation)
- [KubeVirt authentication bypass in migration proxy when TLS is disabled](https://junglewise.ai/threats/cve-2026-13325-kubevirt-authentication-bypass-in-migration-proxy-when-tls-is)
- [KubeVirt unbounded memory allocation in virt-handler virtio-serial server](https://junglewise.ai/threats/cve-2026-13322-kubevirt-unbounded-memory-allocation-in-virt-handler-virtio)
- [KubeVirt SSRF in virt-api port-forward handler](https://junglewise.ai/threats/cve-2026-13318-kubevirt-ssrf-in-virt-api-port-forward-handler)
- [KubeVirt virt-handler symlink following in WriteToCachedFile](https://junglewise.ai/threats/cve-2026-13218-kubevirt-virt-handler-symlink-following-in-writetocachedfile)