PT-2025-23762 · Kro · Kro

Roi Nisimi · Published 2025-06-04 · Updated 2025-07-03 · CVE-2025-48710

Positive Technologies (AI Summary)

CVSS v3.1

4.1

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions kro (Kube Resource Orchestrator) versions 0.1.0 through 0.2.1

Description The issue allows users with permission to create or modify ResourceGraphDefinition resources to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.

Recommendations For versions 0.1.0 through 0.2.1, update to version 0.2.1 or later to resolve the issue. As a temporary workaround, consider restricting access to create or modify ResourceGraphDefinition resources to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-441

Related Identifiers

CVE-2025-48710

GHSA-7633-X85H-5MQH

GO-2025-3741

OPENSUSE-SU-2025:15225-1

Affected Products

Kro

References · 41

• https://osv.dev/vulnerability/GO-2025-3741 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-48710 · Security Note
• https://osv.dev/vulnerability/openSUSE-SU-2025:15225-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7633-x85h-5mqh · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-48710 · Vendor Advisory
• https://github.com/kro-run/kro · Note
• https://github.com/kro-run/kro/compare/v0.2.1...v0.2.2 · Note
• https://suse.com/security/cve/CVE-2025-2571 · Note
• https://suse.com/security/cve/CVE-2025-22874 · Note
• https://suse.com/security/cve/CVE-2025-1792 · Note
• https://suse.com/security/cve/CVE-2025-3611 · Note
• https://t.me/cvenotify/124563 · Telegram Post
• https://suse.com/security/cve/CVE-2025-3230 · Note
• https://orca.security/resources/blog/kubernetes-crd-abstraction-risks-kro · Note
• https://suse.com/security/cve/CVE-2025-3260 · Note