PT-2025-17879 · Cncf · K3S

F1Vet · Published 2025-04-25 · Updated 2025-05-08 · CVE-2025-46599

Positive Technologies (AI Summary)

CVSS v3.1

6.8

Medium

Base vector

AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CNCF K3s versions 1.32 through 1.32.4-rc1+k3s1

Description The issue arises from a Kubernetes kubelet configuration change, which in certain situations, sets ReadOnlyPort to 10255. This could potentially allow unauthenticated access to this port, exposing credentials, particularly in default K3s online installation behaviors.

Recommendations For CNCF K3s versions 1.32 through 1.32.4-rc1+k3s1, update to version 1.32.4-rc1+k3s1 or later to resolve the issue. As a temporary workaround, consider restricting access to port 10255 to minimize the risk of exploitation.

Fix

Weakness Enumeration

CWE-1188

Related Identifiers

CVE-2025-46599

GHSA-864F-7XJM-2JP2

GO-2025-3646

OPENSUSE-SU-2025:15059-1

Affected Products

K3S

References · 31

• https://osv.dev/vulnerability/GO-2025-3646 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-46599 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15059-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-864f-7xjm-2jp2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-46599 · Security Note
• https://github.com/k3s-io/k3s/issues/12164 · Note
• https://github.com/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1 · Note
• https://github.com/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a · Note
• https://github.com/k3s-io/k3s · Note
• https://suse.com/security/cve/CVE-2025-46599 · Note
• https://lists.opensuse.org/archives/list/[e-mail]/thread/HNV7O7SNYYY4AFS5HKAPLITKK3B57LE7 · Note
• https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port · Note
• https://t.me/cvetracker/22345 · Telegram Post
• https://suse.com/security/cve/CVE-2023-32198 · Note
• https://github.com/f1veT/BUG/issues/2 · Note