CVE-2026-9804 Details

A path traversal vulnerability has been identified in the virt-exportserver component of KubeVirt. This issue allows an attacker with specific namespace-level access to exploit the VMExport directory endpoint. By placing a symbolic link within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This vulnerability leads to information disclosure, potentially exposing sensitive data. The issue affects PVCs that do not have the appropriate KubeVirt content type annotation, with namespaces containing mixed workloads being more susceptible.