CVE-2025-24376 The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources
Attackers can manipulate PolicyReport resources via admission policies to hide non-compliant objects, requiring an upgrade to kubewarden-controller.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-24376?
CVE-2025-24376 is a medium-severity missing authorization vulnerability in kubewarden-controller, published on 30 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and AdmissionPolicyGroup can evaluate only namespaced resources. The resources to be evaluated are determined by the rules provided by the user when defining the policy. There might be Kubernetes namespaced resources that should not be validated by AdmissionPolicy and by the AdmissionPolicyGroup policies because of their sensitive nature. For example, PolicyReport are namespaced resources that contain the list of non compliant objects found inside of a namespace. An attacker can use either an AdmissionPolicy or an AdmissionPolicyGroup to prevent the creation and update of PolicyReport objects to hide non-compliant resources. Moreover, the same attacker might use a mutating AdmissionPolicy to alter the contents of the PolicyReport created inside of the namespace. Starting from the 1.21.0 release, the validation rules applied to AdmissionPolicy and AdmissionPolicyGroup have been tightened to prevent them from validating sensitive types of namespaced resources.
Which versions are affected by CVE-2025-24376?
3 open source packages ship an affected version, including github.com/kubewarden/kubewarden-controller.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kubewarden/kubewarden-controller Go | From 1.7.0 | 1.21.0 |
github.com/kubewarden/kubewarden-controller Go | From 1.7.0 | 1.21.0 |
github.com/kubewarden/kubewarden-controller Go | From 1.7.0 | 1.21.0 |
How do I fix CVE-2025-24376?
Upgrade github.com/kubewarden/kubewarden-controller to 1.21.0 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-24376 being exploited?
There is no known exploitation of CVE-2025-24376 in the wild and no public exploit code.
Sources
Also known as GHSA-fc89-jghx-8pvg, GO-2025-3434.