CVE-2025-64434

Aliases:GHSA-ggp9-c99x-54gpGO-2025-4107
Advisory lineage Upstream: 0 Downstream: 5
Analyzed
Published: 07 Nov 2025, 22:54
Last modified:10 Nov 2025, 19:03

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
6.3 MEDIUM
v3.1 (nvd)
EPSS Score
0.18% LOW
0% probability +0.17%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

07 Nov 2025, 22:54
Published
Vulnerability first disclosed
10 Nov 2025, 19:03
Last Modified
Vulnerability information updated

Description

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.

CVSS Metrics

  • v3.1•MEDIUM•Score: 4.7CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
  • v3.1•MEDIUM•Score: 6.3CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H

EPSS Trends

Current EPSS score: 0.18%• Percentile: 8%

Techniques & Countermeasures

  • CWE-287•Improper Authentication

    When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Systems

  • kubevirt.io•kubevirt

    < 1.5.3 | ≥ 1.6.0-alpha.0, < 1.6.1 | ≥ 1.6.0-rc.0, < 1.6.1

  • kubevirt•kubevirt

    ≥ 1.6.0-alpha.0, < 1.6.1 | < 1.5.3 | 1.6.0

References (6)