Improper Authentication in Kubevirt - CVE-2025-64432

 

Improper Authentication in Kubevirt - CVE-2025-64432

Published: November 7, 2025 / Updated: November 7, 2025


Vulnerability identifier: #VU118177
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-64432
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local user to bypass authentication process.

The vulnerability exists due to an error when processing authentication requests in the Kubernetes aggregation layer. A local user can bypass the RBAC controls on the system.


Affected software

Kubevirt
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Containers Module
kubevirt-virtctl-debuginfo
kubevirt-virtctl
kubevirt-manifests

How to mitigate CVE-2025-64432

Cybersecurity Help is currently unaware of any official solution to address this vulnerability.

kubevirt-virtctl-debuginfo - update to 1.6.3-150700.3.13.1
kubevirt-virtctl - update to 1.6.3-150700.3.13.1
kubevirt-manifests - update to 1.6.3-150700.3.13.1

Links to Public Exploits and PoC-codes

External References

Related Security Bulletins