CVE-2025-14459 Virt-cdi-controller: unauthorized pvc cloning via dataimportcron
Attackers can clone PersistentVolumeClaims from unauthorized namespaces via DataImportCron, leading to unauthorized data access in KubeVirt environments.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-14459?
CVE-2025-14459 is a high-severity missing authorization vulnerability in Red Hat RHEL-9-CNV-4.19, published on 26 Jan 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
A flaw was found in KubeVirt Containerized Data Importer (CDI). This vulnerability allows a user to clone PersistentVolumeClaims (PVCs) from unauthorized namespaces, resulting in unauthorized access to data via the DataImportCron PVC source mechanism.
Weakness: CWE-639
Which versions are affected by CVE-2025-14459?
How do I fix CVE-2025-14459?
Apply the vendor's patch.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-14459 being exploited?
There is no known exploitation of CVE-2025-14459 in the wild and no public exploit code.
Sources
Also known as AZL-75395, AZL-75404, AZL-75443, AZL-75446, AZL-75494, GHSA-727r-mf78-ghxp.