PT-2026-4805 · Unknown · Kubevirt Cdi

Published 2026-01-26 · Updated 2026-01-27 · CVE-2025-14459

Positive Technologies (AI Summary)

CVSS v3.1

8.5

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions KubeVirt Containerized Data Importer (CDI) (affected versions not specified)

Description A flaw exists in KubeVirt Containerized Data Importer (CDI) that allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces. This can lead to unauthorized access to data through the DataImportCron PVC source mechanism.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

AZL-75395

AZL-75404

AZL-75443

AZL-75446

AZL-75494

CVE-2025-14459

Affected Products

Kubevirt Cdi

References · 12

• https://osv.dev/vulnerability/AZL-75443 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-75446 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-75404 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2026:0950 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-14459 · Security Note
• https://osv.dev/vulnerability/AZL-75395 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-75494 · Vendor Advisory
• https://twitter.com/CveFindCom/status/2016133456493728191 · Twitter Post
• https://twitter.com/CVEnew/status/2015876122743824519 · Twitter Post
• https://access.redhat.com/security/cve/CVE-2025-14459 · Note
• https://twitter.com/TheHackerWire/status/2015892431984853372 · Twitter Post
• https://bugzilla.redhat.com/show_bug.cgi?id=2420938 · Note