CVE-2025-46599: k3s
CVSS: 6.8v3.1MediumDeferred
AliasesCGA-3398-m4qx-prp8CGA-37qc-6j9g-3pwfCGA-3cg2-qvrw-48rmCGA-3j9g-548v-5w7vCGA-4pfx-v6j6-m2c8CGA-52p8-hcx6-5vv3CGA-583c-wj74-fg4pCGA-5jrc-vvm6-fw73CGA-6m7w-qg8m-366vCGA-727g-fqc7-5gprCGA-82qj-83rx-w227CGA-88h8-mgvp-v935CGA-95g2-8qg9-6pmqCGA-9f6f-xfm5-rr4pCGA-9vq5-3rwv-xrjwCGA-cpqm-g76j-fcvqCGA-cvh3-m275-vf83CGA-gg49-hm68-wg93CGA-gh6m-xvm2-pxj5CGA-h96g-m527-3hg5CGA-jjxg-m4qf-cvjmCGA-jp37-jm4x-7wm4CGA-jvmf-xhcf-47qcCGA-m784-mwcm-h98fCGA-pj6c-wfcf-hpr9CGA-rpfw-48pj-p598GHSA-864f-7xjm-2jp2GO-2025-3646CGA-3q48-2362-458fCGA-3rv8-7mwq-jjmqCGA-4p75-9wrh-8h4rCGA-53wh-w8hr-r43wCGA-5vrx-hq42-7qf7CGA-68x9-r37v-r358CGA-7vm4-m35m-prq8CGA-8rq6-84gv-ghp7CGA-942w-hqjj-m23wCGA-9wgm-hh33-687wCGA-cgx6-7h7x-5j79CGA-f42f-2257-c5qvCGA-f948-8c26-9q44CGA-fwrj-696j-mm7wCGA-gw2f-q3rx-g2w2CGA-gw99-qcjx-3x39CGA-h5h3-97f9-58r3CGA-hfmm-h8xg-qv7gCGA-hp85-6v44-r5mwCGA-mcfj-2g4q-h384CGA-q5gf-jq7g-c3j4CGA-qf57-3m6m-r9qmCGA-r52f-3794-6jjqCGA-w2c5-xpq6-fx75CGA-wh7p-c3wc-hvgrCGA-xw85-qf76-6pvm
Published 25-04-2025Last modified 25-04-2025
Vulnerability summary
CVE-2025-46599 is a medium (CVSS 6.8) vulnerability in k3s. EPSS estimates a 0.45% chance of exploitation in the next 30 days, higher than 37.8% of scored vulnerabilities.
CVSS score
6.8/10
010
Medium · v3.1 (CVE.org)EPSS score
0.45%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 1 · Related 3Timeline
- 25-04-2025PublishedVulnerability first disclosed.
- 25-04-2025Last modifiedVulnerability information updated.
Description
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.
CVSS metrics
5 scores · 5 sources · 1 versionMedium 6.8Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:NSourcesAll 5 agree
- OSV · WolfiEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · GoEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
- NVDNIST6.8MediumCVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N
EPSS trend
Probability
0.45%
Chance of exploitation in the next 30 days
Percentile
38%
Versus all other CVEs
30-day change
+0.02 pp
From 0.43% on 19-09-2026
19-09-202619-10-2026
EPSS score0.45%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard26 products
- k3s< 1.32.4.1-r0
- k3s-1.32< 1.32.6.1-r0
- k3s-multicall< 1.32.4.1-r0
- k3s-multicall-1.31< 1.31.6.1-r27
- k3s-multicall-1.32< 1.32.6.1-r0
Wolfi13 products
- k3s< 1.32.4.1-r0
- k3s-1.32< 1.32.6.1-r0
- k3s-multicall< 1.32.4.1-r0
- k3s-multicall-1.32< 1.32.6.1-r0
- k3s-multicall-1.33All versions (No fix recorded)
Github.com/k3s-io1 product
- k3s≥ 1.32.0-rc1, < 1.32.4-rc1 | All versions (No fix recorded)
K3s1 product
- k3s≥ 1.32, < 1.32.4-rc1+k3s
4 vendors · 41 products
References
10 links
- github.com/k3s-io/k3sPACKAGE