Preface: Does the cloud service provider use KubeVirt to support the operation of customer-supplied VMware images?
Yes, service providers do use KubeVirt to allow customers to provide and run VMware images within a Kubernetes environment. This is a common strategy for “lifting and shifting” legacy workloads to the cloud without undergoing immediate containerization.
Background: In the KubeVirt ecosystem, service providers use the Containerized Data Importer (CDI) to handle the import and conversion of .vmdk files. Regarding on permission isolation and conversion, KubeVirt ensures security through RBAC (Role-Based Access Control) and the DataVolume resource.
1. Isolation and Permission Protection Mechanism
• RBAC Isolation: The import process is executed by a specific ServiceAccount (e.g., cdi-sa). This account’s permissions are strictly separated from the permissions used to actually run the VM, ensuring the import environment is sandboxed.
• Permission Preservation: When CDI imports a .vmdk, it converts it to a raw or qcow2 format within a PersistentVolume (PV). KubeVirt applies specific ownership (usually UID 107) to the resulting image file. This ensures that while the VM can read the disk, other users in the cluster cannot access the underlying data, maintaining strict isolation.
• Role Distinction: The role performing the conversion is different from the owner of the original .vmdk. This “privileged importer” role handles the conversion logic and then hands off the finalized, isolated volume to the user’s VM.
Vulnerability details: A flaw was found in KubeVirt’s Role-Based Access Control (RBAC) evaluation logic. The authorization mechanism improperly truncates subresource names, leading to incorrect permission evaluations. This allows authenticated users with specific custom roles to gain unauthorized access to subresources, potentially disclosing sensitive information or performing actions they are not permitted to do. Additionally, legitimate users may be denied access to resources.
Official announcement: Please refer to link for details – https://nvd.nist.gov/vuln/detail/CVE-2026-6383