Vulnerability · Published Jun 4, 2025 · Assigned by mitre
CVE-2025-48710
Medium 4.1
In plain English
A medium-severity security flaw in kro from kro.run. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 35% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Go | github.com/kro-run/kro | 0.2.1 | GHSA-7633-x85h-5mqh |
| Go | github.com/kro-run/kro | 0.2.1 | GO-2025-3741 |
Affected products (as reported)
Weakness: CWE-441 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N