BaseFortify

Publication date: 2025-11-07

Last updated on: 2025-11-25

Assigner: GitHub, Inc.

Description

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2025-11-07

Last Modified

2025-11-25

Generated

2026-07-06

AI Q&A

2025-11-07

EPSS Evaluated

2026-07-05

NVD

CVE-2025-64432

Affected Vendors & Products

Vendor	Product	Version / Range
kubevirt	kubevirt	to 1.5.3 (exc)
kubevirt	kubevirt	1.6.0
kubevirt	kubevirt	1.6.0
kubevirt	kubevirt	1.6.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-295	The product does not validate, or incorrectly validates, a certificate.
CWE-287	When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Attack-Flow Graph

Executive Summary

This vulnerability in KubeVirt versions 1.5.3 and below, and 1.6.0 involves a flawed authentication flow in the Kubernetes aggregation layer. Specifically, the virt-api component does not properly validate the Common Name (CN) field in client TLS certificates against allowed values. This failure allows an attacker to bypass Role-Based Access Control (RBAC) by impersonating the Kubernetes API server and communicating directly with the aggregated API server.

Impact Analysis

An attacker exploiting this vulnerability could bypass RBAC controls, potentially gaining unauthorized access to the aggregated API server. This could lead to unauthorized actions or disruptions within the Kubernetes environment, impacting the security and stability of virtual machine management.

Mitigation Strategies

Upgrade KubeVirt to version 1.5.3 or 1.6.1 or later, as these versions contain the fix for the flawed authentication flow that allows RBAC bypass via mTLS client certificate validation.

Hi! I’m here to help you understand CVE-2025-64432. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70