Protection Mechanism Failure in Aws-iam-authenticator - CVE-2025-47910

Vulnerability identifier: #VU116686

CSH Severity: Medium

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-47910

CWE-ID: CWE-693

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote attacker to bypass implemented security restrictions.

The vulnerability exists due to insufficient implementation of security measures in http.CrossOriginProtection. The AddInsecureBypassPattern method can unexpectedly bypass more requests than intended. An attacker can bypass implemented security restrictions.

Aws-iam-authenticator
SUSE Linux Enterprise Server 15 SP3
SUSE Linux Enterprise Server 15 SP5
SUSE Linux Enterprise Server 15 SP4
SUSE Linux Enterprise Server 15 SP6
SUSE Linux Enterprise High Performance Computing LTSS 15
SUSE Linux Enterprise Server for SAP Applications 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise High Performance Computing 15
SUSE Linux Enterprise High Performance Computing ESPOS 15
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Desktop 15
SUSE Enterprise Storage
Fedora
Development Tools Module
openSUSE Leap
golang-github-facebook-time
vhs
docker-buildkit
docker-buildx
alertmanager
kitty
xq
apptainer
containerd
containernetworking-plugins
podman-tui
node-exporter
gopass-jsonapi
prometheus-podman-exporter
go1.25-openssl-doc
go1.25-openssl-debuginfo
go1.25-openssl-race
go1.25-openssl
go1.25
go1.25-race
go1.25-doc
cri-o1.31
kubernetes1.31
cri-o1.32
kubernetes1.32
kubernetes1.33
cri-o1.34
kubernetes1.34
chezmoi
gh
git-lfs
prometheus
gitleaks
staticcheck

Install updates from vendor's website.

Aws-iam-authenticator - update to 0.7.8
golang-github-facebook-time - addressed in versions 0^20251021gite970944-1.el9, 0^20251021gite970944-1.fc41, 0^20251021gite970944-1.fc42
vhs - update to 0.10.0-4.fc43
docker-buildkit - addressed in versions 0.25.0-1.fc41, 0.25.0-1.fc42, 0.25.0-1.fc43, 0.25.0-1.fc44
docker-buildx - addressed in versions 0.29.0-1.fc41, 0.29.0-1.fc42, 0.29.0-1.fc43, 0.29.0-1.fc44, 0.29.1-1.fc41, 0.29.1-1.fc42, 0.29.1-1.fc43
alertmanager - addressed in versions 0.31.1-1.el9, 0.31.1-2.fc42
kitty - update to 0.43.0-1.fc42
xq - addressed in versions 1.4.0-2.el9, 1.4.0-2.el10_1, 1.4.0-2.el10_2, 1.4.0-2.el10_3, 1.4.0-2.fc42
apptainer - addressed in versions 1.4.3-1.el8, 1.4.3-1.el9, 1.4.3-1.el10_0, 1.4.3-1.el10_1, 1.4.3-1.el10_2, 1.4.3-1.fc41, 1.4.3-1.fc42, 1.4.3-2.fc43
containerd - addressed in versions 1.7.29-1.fc41, 2.0.7-1.fc42
containernetworking-plugins - addressed in versions 1.8.0-2.fc41, 1.8.0-2.fc42, 1.8.0-2.fc43, 1.8.0-2.fc44
podman-tui - addressed in versions 1.9.0-1.fc41, 1.9.0-1.fc42, 1.9.0-1.fc43
node-exporter - addressed in versions 1.10.2-3.el9, 1.10.2-3.el10_1, 1.10.2-3.el10_2, 1.10.2-3.fc42
gopass-jsonapi - update to 1.16.0-1.fc43
prometheus-podman-exporter - addressed in versions 1.19.0-1.fc41, 1.19.0-1.fc42
go1.25-openssl-doc - addressed in versions 1.25.1-150000.1.6.1, 1.25.1-150600.13.6.1, 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl-debuginfo - addressed in versions 1.25.1-150000.1.6.1, 1.25.1-150600.13.6.1, 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl-race - addressed in versions 1.25.1-150000.1.6.1, 1.25.1-150600.13.6.1, 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25-openssl - addressed in versions 1.25.1-150000.1.6.1, 1.25.1-150600.13.6.1, 1.25.6-150000.1.9.1, 1.25.6-150600.13.9.1
go1.25 - update to 1.25.1-150000.1.8.1
go1.25-race - update to 1.25.1-150000.1.8.1
go1.25-doc - update to 1.25.1-150000.1.8.1
cri-o1.31 - addressed in versions 1.31.13-1.fc41, 1.31.13-1.fc42, 1.31.13-1.fc43, 1.31.13-1.fc44
kubernetes1.31 - addressed in versions 1.31.14-1.fc41, 1.31.14-1.fc42, 1.31.14-1.fc43, 1.31.14-1.fc44
cri-o1.32 - addressed in versions 1.32.9-1.fc41, 1.32.9-1.fc42, 1.32.9-1.fc43, 1.32.9-1.fc44
kubernetes1.32 - addressed in versions 1.32.10-2.fc41, 1.32.10-2.fc42, 1.32.10-2.fc43, 1.32.10-2.fc44
kubernetes1.33 - addressed in versions 1.33.6-1.fc41, 1.33.6-1.fc42, 1.33.6-1.fc43, 1.33.6-1.fc44
cri-o1.34 - addressed in versions 1.34.1-1.fc41, 1.34.1-1.fc42, 1.34.1-1.fc43, 1.34.1-1.fc44
kubernetes1.34 - addressed in versions 1.34.2-1.fc41, 1.34.2-1.fc42, 1.34.2-1.fc43, 1.34.2-1.fc44
chezmoi - addressed in versions 2.69.4-1.el9, 2.69.4-1.el10_2, 2.69.4-1.el10_3, 2.69.4-1.fc42
gh - update to 2.83.0-1.el10_2
git-lfs - addressed in versions 3.7.1-1.fc41, 3.7.1-1.fc42
prometheus - update to 3.10.0-1.fc42
gitleaks - update to 8.29.0-1.fc42
staticcheck - update to 2026.1-1.el9

• https://github.com/kubernetes-sigs/aws-iam-authenticator/releases/tag/v0.7.8
• https://github.com/kubernetes-sigs/aws-iam-authenticator/commit/e5c37d0bc4d181c87f9c1e0e4cd022adbfb48ad3

• Security restrictions bypass in aws-iam-authenticator
• Fedora 44 update for containernetworking-plugins
• Fedora 43 update for containernetworking-plugins
• Fedora 42 update for containernetworking-plugins
• Fedora 41 update for containernetworking-plugins
• Fedora 42 update for kitty
• Fedora EPEL 8 update for apptainer
• Fedora EPEL 10.2 update for apptainer
• Fedora 43 update for apptainer
• Fedora EPEL 10.1 update for apptainer
• Fedora 41 update for apptainer
• Fedora EPEL 10.0 update for apptainer
• Fedora 42 update for apptainer
• Fedora EPEL 9 update for apptainer
• Fedora 44 update for docker-buildx
• Fedora 44 update for docker-buildkit
• Fedora 43 update for docker-buildx
• Fedora 42 update for docker-buildx
• Fedora 43 update for docker-buildkit
• Fedora 41 update for docker-buildx
• Fedora 42 update for docker-buildkit
• Fedora 41 update for docker-buildkit
• Fedora 44 update for cri-o1.34
• Fedora 44 update for cri-o1.32
• Fedora 44 update for cri-o1.31
• Fedora 43 update for cri-o1.34
• Fedora 43 update for cri-o1.32
• Fedora 43 update for cri-o1.31
• Fedora 42 update for cri-o1.34
• Fedora 42 update for cri-o1.32
• Fedora 42 update for cri-o1.31
• Fedora 41 update for cri-o1.34
• Fedora 41 update for cri-o1.31
• Fedora 41 update for cri-o1.32
• Fedora 43 update for docker-buildx
• Fedora 42 update for docker-buildx
• Fedora 41 update for docker-buildx
• Fedora 42 update for podman-tui
• Fedora 43 update for podman-tui
• Fedora 41 update for podman-tui
• Fedora 41 update for prometheus-podman-exporter
• Fedora 42 update for prometheus-podman-exporter
• SUSE update for go1.25
• SUSE update for go1.25-openssl
• SUSE update for go1.25-openssl
• Fedora 42 update for golang-github-facebook-time
• Fedora EPEL 9 update for golang-github-facebook-time
• Fedora 41 update for golang-github-facebook-time
• Fedora 42 update for gitleaks
• Fedora EPEL 10.2 update for gh
• Fedora 41 update for containerd
• Fedora 42 update for containerd
• Fedora 41 update for git-lfs
• Fedora 42 update for git-lfs
• Fedora 44 update for kubernetes1.31
• Fedora 43 update for kubernetes1.31
• Fedora 42 update for kubernetes1.31
• Fedora 41 update for kubernetes1.31
• Fedora 44 update for kubernetes1.32
• Fedora 43 update for kubernetes1.32
• Fedora 42 update for kubernetes1.32
• Fedora 41 update for kubernetes1.32
• Fedora 43 update for gopass-jsonapi
• Fedora 44 update for kubernetes1.34
• Fedora 43 update for kubernetes1.34
• Fedora 42 update for kubernetes1.34
• Fedora 41 update for kubernetes1.34
• Fedora 44 update for kubernetes1.33
• Fedora 43 update for kubernetes1.33
• Fedora 42 update for kubernetes1.33
• Fedora 41 update for kubernetes1.33
• SUSE update for go1.25-openssl
• SUSE update for go1.25-openssl
• Fedora 42 update for node-exporter
• Fedora EPEL 10.2 update for node-exporter
• Fedora EPEL 10.1 update for node-exporter
• Fedora EPEL 9 update for node-exporter
• Fedora 42 update for prometheus
• Fedora EPEL 9 update for staticcheck
• Fedora EPEL 10.3 update for chezmoi
• Fedora EPEL 10.2 update for chezmoi
• Fedora EPEL 9 update for chezmoi
• Fedora 42 update for chezmoi
• Fedora EPEL 9 update for xq
• Fedora 42 update for xq
• Fedora EPEL 10.2 update for xq
• Fedora EPEL 10.3 update for xq
• Fedora EPEL 10.1 update for xq
• Fedora EPEL 9 update for alertmanager
• Fedora 42 update for alertmanager
• Fedora 43 update for vhs