CVSS 3.1
6.3 mediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:HCVE-2025-64434
Medium (6.3) in kubevirt kubevirt. EPSS 0.2% chance of exploitation in the next 30 days. Fixed in kubevirt.io/kubevirt 1.5.3, 1.6.0-beta.0.0.20250730135146-231dc69723f3, 1.6.1.
KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.
Severity
- EPSS
- 0.2% chance of exploitation in the next 30 days; higher than 9% of CVEs (scores of 2026-10-31)
- CWE
- CWE-287
- Published
- Modified
- Record from
- the NVD, synced
Affected
- kubevirt:kubevirt
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-ggp9-c99x-54gp | Go | kubevirt.io/kubevirt | <1.5.3 | 1.5.3 |
| GHSA-ggp9-c99x-54gp | Go | kubevirt.io/kubevirt | >=1.6.0-alpha.0 <1.6.1 | 1.6.1 |
| GO-2025-4107 | Go | kubevirt.io/kubevirt | <1.5.3 >=1.6.0-alpha.0 <1.6.0-beta.0.0.20250730135146-231dc69723f3 >=1.6.0-rc.0 <1.6.1 | 1.5.3, 1.6.0-beta.0.0.20250730135146-231dc69723f3, 1.6.1 |
References
- https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a
- https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b
- https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074
- https://github.com/kubevirt/kubevirt/security/advisories/GHSA-ggp9-c99x-54gp