PT-2025-41491 · Unknown · Confidential Containers Trustee

Esposem · Published 2025-10-09 · Updated 2025-10-09 · CVE-2025-61779

Positive Technologies (AI Summary)

CVSS v4.0

8.7

High

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Confidential Containers Trustee versions prior to 0.15.0

Description The Confidential Containers Trustee project, which includes tools for attesting confidential guests and providing secrets, had a flaw in the attestation-policy endpoint. Before version 0.15.0, the endpoint did not verify the authentication of the kbs-client making the request, allowing any client to modify the attestation policy. The kbs-client could submit requests to the /attestation-policy API endpoint without proper authentication.

Recommendations Update to version 0.15.0 or later.

Exploit

Fix

IDOR

Weakness Enumeration

CWE-639

Related Identifiers

CVE-2025-61779

GHSA-49MC-2Q77-M99X

Affected Products

Confidential Containers Trustee

References · 7

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/61xxx/CVE-2025-61779.json · Exploit
• 🔥 https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2025-61779 · Security Note
• https://osv.dev/vulnerability/CVE-2025-61779 · Vendor Advisory
• https://github.com/confidential-containers/trustee/pull/957 · Note
• https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0 · Note
• https://twitter.com/CVEnew/status/1976396262665773133 · Twitter Post