Improper Authentication in Kubevirt - CVE-2025-64432
Published: November 7, 2025 / Updated: November 7, 2025
Vulnerability identifier: #VU118177
CSH Severity: Low
CVSS v4: 5.7 [CVSS:4.0/AV:L/AC:L/AT:P/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2025-64432
CWE-ID: CWE-287
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local user to bypass authentication process.
The vulnerability exists due to an error when processing authentication requests in the Kubernetes aggregation layer. A local user can bypass the RBAC controls on the system.
Affected software
Kubevirt
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Containers Module
kubevirt-virtctl-debuginfo
kubevirt-virtctl
kubevirt-manifests
SUSE Linux Enterprise Real Time 15
SUSE Linux Enterprise Server 15
SUSE Linux Enterprise Server for SAP Applications 15
Containers Module
kubevirt-virtctl-debuginfo
kubevirt-virtctl
kubevirt-manifests
How to mitigate CVE-2025-64432
Cybersecurity Help is currently unaware of any official solution to address this vulnerability.
kubevirt-virtctl-debuginfo - update to 1.6.3-150700.3.13.1
kubevirt-virtctl - update to 1.6.3-150700.3.13.1
kubevirt-manifests - update to 1.6.3-150700.3.13.1
kubevirt-virtctl - update to 1.6.3-150700.3.13.1
kubevirt-manifests - update to 1.6.3-150700.3.13.1