PT-2025-45512 · Kubevirt+1 · Kubevirt+1

Published 2025-11-06 · Updated 2026-02-27 · CVE-2025-64434

Positive Technologies (AI Summary)

CVSS v3.1

6.3

Medium

Base vector

AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions KubeVirt versions prior to 1.5.3 KubeVirt versions prior to 1.6.1

Description KubeVirt is a virtual machine management add-on for Kubernetes. A flaw exists in the peer verification logic within virt-handler via the verifyPeerCert function. An attacker compromising a virt-handler instance could exploit shared credentials to impersonate virt-api and perform privileged operations against other virt-handler instances, potentially compromising the integrity and availability of managed virtual machines.

Recommendations Update to KubeVirt version 1.5.3 or later. Update to KubeVirt version 1.6.1 or later.

Exploit

Fix

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

AZL-69796

AZL-69961

CVE-2025-64434

GHSA-GGP9-C99X-54GP

GO-2025-4107

OPENSUSE-SU-2026:20281-1

SUSE-SU-2025:4330-1

SUSE-SU-2026:20551-1

SUSE-SU-2026:20610-1

Affected Products

Kubevirt

Suse

References · 42

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/64xxx/CVE-2025-64434.json · Exploit
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-ggp9-c99x-54gp · Vendor Advisory
• https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a · Patch
• https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b · Patch
• https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074 · Patch
• https://osv.dev/vulnerability/SUSE-SU-2025:4330-1 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-ggp9-c99x-54gp · Vendor Advisory
• https://osv.dev/vulnerability/GO-2025-4107 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20610-1 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2026:20281-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-64434 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69961 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2026:20551-1 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-69796 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-64434 · Security Note