CVE-2025-64432
Unknown Unknown - Not Provided
BaseFortify

Publication date: 2025-11-07

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description
KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-11-07
Last Modified
2025-11-25
Generated
2026-05-07
AI Q&A
2025-11-07
EPSS Evaluated
2026-05-05
NVD
CVE-2025-64432
Affected Vendors & Products
Showing 4 associated CPEs
Vendor Product Version / Range
kubevirt kubevirt to 1.5.3 (exc)
kubevirt kubevirt 1.6.0
kubevirt kubevirt 1.6.0
kubevirt kubevirt 1.6.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-287 When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.
CWE-295 The product does not validate, or incorrectly validates, a certificate.
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?

This vulnerability in KubeVirt versions 1.5.3 and below, and 1.6.0 involves a flawed authentication flow in the Kubernetes aggregation layer. Specifically, the virt-api component does not properly validate the Common Name (CN) field in client TLS certificates against allowed values. This failure allows an attacker to bypass Role-Based Access Control (RBAC) by impersonating the Kubernetes API server and communicating directly with the aggregated API server.


How can this vulnerability impact me? :

An attacker exploiting this vulnerability could bypass RBAC controls, potentially gaining unauthorized access to the aggregated API server. This could lead to unauthorized actions or disruptions within the Kubernetes environment, impacting the security and stability of virtual machine management.


What immediate steps should I take to mitigate this vulnerability?

Upgrade KubeVirt to version 1.5.3 or 1.6.1 or later, as these versions contain the fix for the flawed authentication flow that allows RBAC bypass via mTLS client certificate validation.


Ask Our AI Assistant
Need more information? Ask your question to get an AI reply (Powered by our expertise)
0/70
EPSS Chart