CVE-2026-17527

In containerized-data-importer CDI, the aggregated cdi.kubevirt.io:view ClusterRole, intended to provide read-only access to CDI resources, includes a rule granting create on the datavolumes/source subresource. CDI's DataVolume clone authorization accepts this permission as sufficient to authoriz...

PT-2026-64872

Name of the Vulnerable Software and Affected Versions containerized-data-importer affected versions not specified Description The aggregated cdi.kubevirt.io:view ClusterRole, designed for read-only access to resources, incorrectly grants create permissions on the datavolumes/source subresource. T...