PT-2025-45491 · Kubevirt+2 · Kubevirt+2

Published 2025-11-06 · Updated 2026-02-27 · CVE-2025-64432

Positive Technologies (AI Summary)

CVSS v3.1

4.7

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions KubeVirt versions 1.5.3 and below KubeVirt version 1.6.0

Description KubeVirt, a virtual machine management add-on for Kubernetes, has an issue in its authentication flow within the Kubernetes aggregation layer. The virt-api component does not properly authenticate clients receiving API requests over mTLS, specifically failing to validate the Common Name (CN) field in client TLS certificates against allowed values defined in the extension-apiserver-authentication configmap. This can allow an attacker to bypass Role-Based Access Control (RBAC) controls by communicating directly with the aggregated API server, potentially impersonating the Kubernetes API server and its aggregator component.

Recommendations Update to KubeVirt version 1.5.3 or later. Update to KubeVirt version 1.6.1 or later.

Exploit

Fix

Improper Authentication

Improper Certificate Validation

Weakness Enumeration

CWE-287

CWE-295

Related Identifiers

AZL-69793

AZL-69890

CVE-2025-64432

GHSA-38JW-G2QX-4286

GO-2025-4103

OPENSUSE-SU-2026:20281-1

SUSE-SU-2025:4330-1

SUSE-SU-2026:20551-1

SUSE-SU-2026:20610-1

Affected Products

Kubevirt

Kubernetes

Suse

References · 44

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64432.json · Exploit
• https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a · Patch
• https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b · Patch
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-38jw-g2qx-4286 · Vendor Advisory
• https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074 · Patch
• https://osv.dev/vulnerability/GO-2025-4103 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2025:4330-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64432 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-38jw-g2qx-4286 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69890 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20281-1 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20551-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69793 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64432 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:20610-1 · Vendor Advisory