CVE-2025-64432
published 2025-11-07CVE-2025-64432: KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes…
PriorityP424medium4.7CVSS 3.1
AVLACHPRLUINSUCNINAH
EPSS
0.13%
2.9th percentile
KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| kubevirt.io | kubevirt | >= 0 < 1.5.3 | 1.5.3 |
| kubevirt.io | kubevirt | >= 1.6.0-alpha.0 < 1.6.1 | 1.6.1 |
| kubevirt.io | kubevirt | >= 1.6.0-alpha.0 < 1.6.0-beta.0.0.20250730135146-231dc69723f3 | 1.6.0-beta.0.0.20250730135146-231dc69723f3 |
| kubevirt.io | kubevirt | >= 1.6.0-rc.0 < 1.6.1 | 1.6.1 |
| kubevirt.io | kubevirt | >= 1.6.2 < 1.7.0-rc.0 | 1.7.0-rc.0 |
| kubevirt.io | kubevirt | >= 1.7.0-alpha.0 < 1.7.0-rc.0 | 1.7.0-rc.0 |
| kubevirt | kubevirt | < 1.5.3 | 1.5.3 |
| kubevirt | kubevirt | — | — |
| kubevirt | kubevirt | — | — |
| msrc | azl3_kubevirt_1.5.0-5_on_azure_linux_3.0 | — | — |
| msrc | cbl2_kubevirt_0.59.0-30_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kubevirt_0.59.0-31_on_cbl_mariner_2.0 | — | — |
| msrc | cbl2_kubevirt_0.59.0-33_on_cbl_mariner_2.0 | — | — |
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
vendor_msrc4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
vendor_msrc·2025-11-11·CVSS 4.7
CVE-2025-64432 [MEDIUM] CWE-287 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
Mariner: Mariner
GitHub_M: GitHub_M
Customer Action Required: Yes
Remediation: CBL-Mariner Releases
Reference: https://learn.microsoft.com/en-us/azure/azure-linux/tutorial-azure-linux-upgrade
Red Hat
kubevirt.io/kubevirt: KubeVirt Authentication Bypass in Kubernetes Aggregation Layer
vendor_redhat·2025-11-07·CVSS 4.7
CVE-2025-64432 [MEDIUM] CWE-295 kubevirt.io/kubevirt: KubeVirt Authentication Bypass in Kubernetes Aggregation Layer
kubevirt.io/kubevirt: KubeVirt Authentication Bypass in Kubernetes Aggregation Layer
KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with th
OSV
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt
osv·2025-11-17
CVE-2025-64432 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer in kubevirt.io/kubevirt
OSV
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
osv·2025-11-06
CVE-2025-64432 [MEDIUM] KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
### Summary
_Short summary of the problem. Make the impact and severity as clear as possible.
A flawed implementation of the Kubernetes aggregation layer's authentication flow could enable bypassing RBAC controls.
### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._
It was discovered that the `virt-api` component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the `extension-apiserver-authentication` configmap.
The Kubernetes API server proxies received
GHSA
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
ghsa·2025-11-06
CVE-2025-64432 [MEDIUM] CWE-287 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
### Summary
_Short summary of the problem. Make the impact and severity as clear as possible.
A flawed implementation of the Kubernetes aggregation layer's authentication flow could enable bypassing RBAC controls.
### Details
_Give all details on the vulnerability. Pointing to the incriminated source code is very helpful for the maintainer._
It was discovered that the `virt-api` component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the `extension-apiserver-authentication` configmap.
The Kubernetes API server proxies received
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6ahttps://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5bhttps://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074https://github.com/kubevirt/kubevirt/security/advisories/GHSA-38jw-g2qx-4286
2025-11-07
Published