CVE-2025-64432
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-07

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description
KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-07
Last Modified
2025-11-25
Generated
2026-06-16
AI Q&A
2025-11-07
EPSS Evaluated
2026-06-15
NVD
CVE-2025-64432
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
kubevirt kubevirt to 1.5.3 (exc)
kubevirt kubevirt 1.6.0
kubevirt kubevirt 1.6.0
kubevirt kubevirt 1.6.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-295 The product does not validate, or incorrectly validates, a certificate.
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Executive Summary

This vulnerability in KubeVirt versions 1.5.3 and below, and 1.6.0 involves a flawed authentication flow in the Kubernetes aggregation layer. Specifically, the virt-api component does not properly validate the Common Name (CN) field in client TLS certificates against allowed values. This failure allows an attacker to bypass Role-Based Access Control (RBAC) by impersonating the Kubernetes API server and communicating directly with the aggregated API server.

Impact Analysis

An attacker exploiting this vulnerability could bypass RBAC controls, potentially gaining unauthorized access to the aggregated API server. This could lead to unauthorized actions or disruptions within the Kubernetes environment, impacting the security and stability of virtual machine management.

Mitigation Strategies

Upgrade KubeVirt to version 1.5.3 or 1.6.1 or later, as these versions contain the fix for the flawed authentication flow that allows RBAC bypass via mTLS client certificate validation.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-64432. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart