Vulnerability · Published Oct 9, 2025 · Assigned by GitHub_M

CVE-2025-61779Trustee's attestation-policy endpoint is not protected by admin autentication

High 8.7

In plain English

A high-severity authorization bypass via user-controlled key in trustee from confidential-containers. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 39% of all known vulnerabilities).

Severity (CVSS 4.0)8.7High

Exploit odds (30 days)0.4%top 60.9% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.

Affected products (as reported)

Vendor	Product	Versions
confidential-containers	trustee	< 0.15.0

Weakness: CWE-639 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

References

https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x x_refsource_CONFIRM
https://github.com/confidential-containers/trustee/pull/957 x_refsource_MISC
https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0 x_refsource_MISC