CVE-2025-14459 Virt-cdi-controller: unauthorized pvc cloning via dataimportcron
A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.
Problem types: cwe_id: CWE-639
description: Authorization Bypass Through User-Controlled Key
Affected products: vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: RHEL-9-CNV-4.19
cpes: cpe:/a:redhat:container_native_virtualization:4.19::el9
default_status: affected
vendor: Red Hat
product: Red Hat OpenShift Virtualization 4
cpes: cpe:/a:redhat:container_native_virtualization:4
default_status: unaffected
CVSS v3.1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 8.5
baseSeverity: HIGH
confidentialityImpact: HIGH
integrityImpact: LOW
privilegesRequired: LOW
scope: CHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N
version: 3.1
Published: 2026-01-26T19:36:29.709Z