CVE-2026-17527 Details

A vulnerability exists in the Kubevirt Containerized-Data-Importer (CDI) within the aggregated 'cdi.kubevirt.io:view' ClusterRole. This role, meant for read-only access to CDI resources, improperly includes a rule that allows creating 'DataVolumes' from the 'source' subresource. As a result, users or service accounts with this role, who also have write access in any namespace, can clone data from any Persistent Volume Claim (PVC) in the cluster to a namespace they control. This exploitation bypasses namespace isolation and the intended read-only nature of the 'view' role.

Cluster administrators are advised not to grant the 'cdi.kubevirt.io:view' role via cluster-wide ClusterRoleBinding. Instead, use namespace-scoped RoleBindings and review which namespaces allow both view-equivalent access and separate edit/admin rights to the same users, as this combination facilitates cross-namespace data exfiltration.