Log in Start free

Vulnerability · Published Nov 7, 2025 · Assigned by GitHub_M

CVE-2025-64432KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer

Medium 4.7

In plain English

A medium-severity improper authentication in kubevirt from kubevirt. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.1% (higher than 4% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)4.7Medium
Exploit odds (30 days)0.1%top 96.1% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known

Official description

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Gokubevirt.io/kubevirt1.5.3GHSA-38jw-g2qx-4286
Gokubevirt.io/kubevirt1.6.1GHSA-38jw-g2qx-4286
Gokubevirt.io/kubevirt1.7.0-rc.0GHSA-38jw-g2qx-4286
Gokubevirt.io/kubevirt1.5.3, 1.6.0-beta.0.0.20250730135146-231dc69723f3, 1.6.1, 1.7.0-rc.0GO-2025-4103

Affected products (as reported)

VendorProductVersions
kubevirt kubevirt < 1.5.3>= 1.6.0, < 1.6.1

Weakness: CWE-287, CWE-295 · Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

References