Skip to content
Threat Feed
Subscribe

Product

Containerized Data Importer (CDI)

1 brief RSS
high advisory

CVE-2026-17527: Kubernetes CDI Privilege Escalation and Data Exfiltration

A vulnerability in the Containerized Data Importer (CDI) for Kubernetes, identified as CVE-2026-17527, allows privilege escalation and data exfiltration through an improperly configured `cdi.kubevirt.io:view` ClusterRole, enabling attackers with partial access to clone and access data from any PersistentVolumeClaim in the cluster.

Containerized Data Importer containerization kubernetes privilege-escalation data-exfiltration cloud
3t 1c