CVSS 3.1
4.1 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:NCVE-2025-48710
Medium (4.1). EPSS 0.4% chance of exploitation in the next 30 days. Fixed in github.com/kro-run/kro 0.2.1.
kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.
Severity
- EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 34% of CVEs (scores of 2026-10-31)
- CWE
- CWE-441
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-7633-x85h-5mqh | Go | github.com/kro-run/kro | >=0.1.0 <0.2.1 | 0.2.1 |
| GO-2025-3741 | Go | github.com/kro-run/kro | <0.2.1 | 0.2.1 |