CVE-2026-9804— Kubevirt 后置链接漏洞
Possible ATT&CK Techniques 2AI
T1552.006 · Group Policy Preferences T1083 · File and Directory DiscoveryAffected Version Matrix 6
| ベンダー | プロダクト | Version Range | ステータス |
|---|---|---|---|
| Red Hat | Red Hat Container Native Virtualization 4.17 | 1781757410< * | unaffected |
| Red Hat | Red Hat Container Native Virtualization 4.18 | 1781928221< * | unaffected |
| Red Hat | Red Hat Container Native Virtualization 4.19 | 1781590993< * | unaffected |
| Red Hat | Red Hat Container Native Virtualization 4.2 | 1781838712< * | unaffected |
| Red Hat | Red Hat Container Native Virtualization 4.21 | 1782012918< * | unaffected |
| Red Hat | Red Hat OpenShift Virtualization 4 | any | affected |
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2026-9804の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Kubevirt: kubevirt: vmexport directory symlink escape enables exporter pod file read
ソース: CVE Program / CVE List V5
脆弱性説明
A flaw was found in KubeVirt's virt-exportserver component. An attacker with specific namespace-level access can exploit a path traversal vulnerability in the VMExport directory endpoint. By placing a symbolic link (symlink) within an exported filesystem Persistent Volume Claim (PVC) that points outside its designated mount root, the attacker can read arbitrary files from the exporter pod's filesystem. This leads to information disclosure, potentially exposing sensitive data.
ソース: CVE Program / CVE List V5
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N
ソース: CVE Program / CVE List V5
脆弱性タイプ
在文件访问前对链接解析不恰当(链接跟随)
ソース: CVE Program / CVE List V5
脆弱性タイトル
Kubevirt 后置链接漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Kubevirt是KubeVirt开源的一款虚拟机管理器。 KubeVirt存在后置链接漏洞，该漏洞源于VMExport目录端点中的路径遍历问题，可能导致具有特定命名空间级别访问权限的攻击者通过在被导出的文件系统持久卷声明中放置指向其指定挂载根目录之外的符号链接，读取导出器Pod文件系统中的任意文件，从而导致信息泄露。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Red Hat | Red Hat Container Native Virtualization 4.17 | 1781757410 ~ * | cpe:/a:redhat:container_native_virtualization:4.17::el9 | |
| Red Hat | Red Hat Container Native Virtualization 4.18 | 1781928221 ~ * | cpe:/a:redhat:container_native_virtualization:4.18::el9 | |
| Red Hat | Red Hat Container Native Virtualization 4.19 | 1781590993 ~ * | cpe:/a:redhat:container_native_virtualization:4.19::el9 | |
| Red Hat | Red Hat Container Native Virtualization 4.2 | 1781838712 ~ * | cpe:/a:redhat:container_native_virtualization:4.20::el9 | |
| Red Hat | Red Hat Container Native Virtualization 4.21 | 1782012918 ~ * | cpe:/a:redhat:container_native_virtualization:4.21::el9 | |
| Red Hat | Red Hat OpenShift Virtualization 4 | - | cpe:/a:redhat:container_native_virtualization:4 |
II. CVE-2026-9804の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2026-9804のインテリジェンス情報
请登录查看更多情报信息。
CVE-2026-9804 厂商安全公告 (2)
- 🔗 2482487 – (CVE-2026-9804) CVE-2026-9804 kubevirt: kubevirt: VMExport directory symlink escape enables exporter pod file read 記事全文を読む issue-trackingx_refsource_REDHAT
- 🔗 RHSA-2026:27913 - Security Advisory - Red Hat Customer Portal 記事全文を読む vendor-advisoryx_refsource_REDHAT
CVE-2026-9804 其他参考 (5)
Same Patch Batch · Red Hat · 2026-05-28 · 14 CVEs total
| CVE-2026-4408 | 9.0 CRITICAL | Samba: remote code execution in samr |
| CVE-2026-9795 | 7.3 HIGH | Keycloak: keycloak: privilege escalation via improper scope mapping enforcement |
| CVE-2026-44604 | 7.0 HIGH | Rpm: command injection in rpmuncompress dountar() via unescaped archive top-level director |
| CVE-2026-9802 | 6.8 MEDIUM | Keycloak: keycloak: unauthorized account access via replayed refresh tokens after cluster |
| CVE-2026-9792 | 6.5 MEDIUM | Keycloak: keycloak: security restriction bypass allows unauthorized ropc token acquisition |
| CVE-2026-9796 | 6.5 MEDIUM | Keycloak: keycloak: privilege escalation via time-of-check to time-of-use (toctou) vulnera |
| CVE-2026-9793 | 5.9 MEDIUM | Keycloak: keycloak: security policy bypass in jwe-encrypted request object processing |
| CVE-2026-9794 | 5.3 MEDIUM | Keycloak: keycloak: information disclosure via saml ecp endpoint |
| CVE-2026-9803 | 5.3 MEDIUM | Keycloak: keycloak: denial of service via malformed authorization header |
| CVE-2026-9801 | 4.9 MEDIUM | Keycloak: keycloak: denial of service via malformed ldap password policy response |
| CVE-2026-9791 | 4.3 MEDIUM | Keycloak-rhel9: organization data leak after feature disabled in keycloak |
| CVE-2026-9798 | 4.3 MEDIUM | Keycloak: keycloak: brute-force protection bypass in ciba flow |
| CVE-2026-10028 | 4.3 MEDIUM | Glib-networking: infinite loop in glib-networking gnutls backend allows remote denial of s |
IV. 関連脆弱性
同じベンダー: Red Hat
- CVE-2026-18103
Dhcp-server: dhcp-server: persistent denial of service due t - CVE-2026-68743
Sssd: sssd: pam responder out-of-bounds read via unchecked a - CVE-2026-70368
Stunnel: stack-based out-of-bounds read/write in stunnel s_v - CVE-2026-70367
Stunnel: ssrf bypass in stunnel socks proxy via ipv4-mapped - CVE-2026-18739
Popt-devel: popt-static: off-by-one in poptstuffargs
同じ弱点: CWE-59
- CVE-2026-40717
Dell Monitor驱动1.0.0.0提权漏洞 - CVE-2026-18508
Tar: tar: --one-top-level hardlink targets not confined to t - CVE-2026-54706
OnionShare follows symlinks in shared directories, allowing - CVE-2026-67433
Linuxfabrik monitoring-plugins: Symlink following in logfile - CVE-2026-13268
G DATA Total Security Backup Service Link Following Local Pr
V. CVE-2026-9804へのコメント
まだコメントはありません