CVE-2026-9804

Estado: Pendiente de análisisAlta (7.7)—

A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.

CVSS

Versión: 3.1
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
Puntuación base: 7.7

Probabilidad de explotación (EPSS)

Probabilidad de explotación en los próximos 30 días: 0.72%
Percentil entre todas las CVEs puntuadas: 52
Fecha de la puntuación: 4/10/2026

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

🎯 Técnicas ATT&CK

Cómo se explota esta vulnerabilidad y qué consigue el atacante, en el lenguaje de MITRE ATT&CK.

ExplotaciónT1210 Exploitation of Remote Serviceslateral movement85 %
Impacto principalT1005 Data from Local Systemcollection90 %
Impacto secundarioT1552 Unsecured Credentialscredential access75 %

Vector N/AC:L/PR:L indica red con privilegios bajos (acceso autenticado a namespace). Path traversal via symlink en virt-exportserver permite leer archivos arbitrarios del pod; CWE-59 confirma traversal. Impactos: acceso a datos locales (T1005) y potencial exposición de secretos (T1552).

Inferido por nuestro agente de análisis a partir de la descripción oficial, el vector CVSS y la CWE, y comprobado por un supervisor. Puede contener errores.

🛡️ Mitigaciones ATT&CK que cubren estas técnicas

Privileged Account Management Update Software Active Directory Configuration Vulnerability Scanning User Training Threat Intelligence Program

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Kubevirt — Virt Exportserver^AI

CWE

CWE-59
CWE-59

Referencias

JSON original (NVD)

Mostrar

{
  "id": "CVE-2026-9804",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-9804",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-05-30T01:54:32.833433Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secalert@redhat.com",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      },
      {
        "type": "Secondary",
        "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 7.7,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 3.1
      }
    ]
  },
  "affected": [
    {
      "source": "secalert@redhat.com",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "1781757410",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.18::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.18",
          "versions": [
            {
              "status": "unaffected",
              "version": "1781928221",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.19::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.19",
          "versions": [
            {
              "status": "unaffected",
              "version": "1781590993",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.20::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.20",
          "versions": [
            {
              "status": "unaffected",
              "version": "1781838712",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.21::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.21",
          "versions": [
            {
              "status": "unaffected",
              "version": "1782012918",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Virtualization 4",
          "packageName": "container-native-virtualization/virt-exportserver",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        }
      ]
    },
    {
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "affectedData": [
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.17::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.17",
          "versions": [
            {
              "status": "unaffected",
              "version": "1781757410",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.18::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.18",
          "versions": [
            {
              "status": "unaffected",
              "version": "1781928221",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.19::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.19",
          "versions": [
            {
              "status": "unaffected",
              "version": "1781590993",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.20::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.20",
          "versions": [
            {
              "status": "unaffected",
              "version": "1781838712",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4.21::el9"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat Container Native Virtualization 4.21",
          "versions": [
            {
              "status": "unaffected",
              "version": "1782012918",
              "lessThan": "*",
              "versionType": "rpm"
            }
          ],
          "packageName": "container-native-virtualization/virt-exportserver-rhel9",
          "collectionURL": "https://catalog.redhat.com/software/containers/",
          "defaultStatus": "affected"
        },
        {
          "cpes": [
            "cpe:/a:redhat:container_native_virtualization:4"
          ],
          "vendor": "Red Hat",
          "product": "Red Hat OpenShift Virtualization 4",
          "packageName": "container-native-virtualization/virt-exportserver",
          "collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
          "defaultStatus": "affected"
        }
      ]
    }
  ],
  "published": "2026-05-28T09:16:49.500",
  "references": [
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:27903",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:27913",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:27914",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:27983",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:28002",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-9804",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482487",
      "source": "secalert@redhat.com"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:27903",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:27913",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:27914",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:27983",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/errata/RHSA-2026:28002",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://access.redhat.com/security/cve/CVE-2026-9804",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2482487",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    },
    {
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-9804.json",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secalert@redhat.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    },
    {
      "type": "Secondary",
      "source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
      "description": [
        {
          "lang": "en",
          "value": "CWE-59"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data."
    }
  ],
  "lastModified": "2026-09-10T13:20:35.120",
  "sourceIdentifier": "secalert@redhat.com"
}