CVE-2025-64432

CWE-287 — Improper AuthenticationCWE-295 — Improper Certificate Validation7 documents6 sources
Severity
4.7MEDIUM
EPSS
0.0%
top 97.90%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Kubevirt KubevirtKubevirt.io Kubevirt
Timeline
PublishedNov 7
Latest updateNov 17

Description

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values…

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:HExploitability: 1.0 | Impact: 3.6

Affected Packages3 packages

▶CVEListV5kubevirt/kubevirt< 1.5.3+1
▶NVDkubevirt/kubevirt< 1.5.3+1
▶Gokubevirt.io/kubevirt1.6.0-alpha.0 — 1.6.1+5

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

4
OSV
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt↗2025-11-17
▶
CVEList
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer↗2025-11-07
▶
OSV
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer↗2025-11-06
▶
GHSA
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer↗2025-11-06
▶

📋Vendor Advisories

2
Microsoft
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer↗2025-11-11
▶
Red Hat
kubevirt.io/kubevirt: KubeVirt Authentication Bypass in Kubernetes Aggregation Layer↗2025-11-07
▶
CVE-2025-64432 (MEDIUM CVSS 4.7) | KubeVirt is a virtual machine manag | cvebase.io