CVE-2026-17527

Microsoft · Published August 7, 2026

7.7

CVSS v3.1

HIGH

Patch availableGet patch

Description

Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone. Virt-cdi-operator: containerized-data-importer: cdi.kubevirt.io:view aggregated clusterrole grants create on datavolumes/source, allowing unauthorized pvc clone

Affected Products

azl3 containerized-data-importer 1.62.0-7 on Azure Linux 3.0
azl3 kubevirt 1.7.1-8 on Azure Linux 3.0

CVSS Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N