{"answers":{"affected":"3 open source packages ship an affected version, including github.com/kubewarden/kubewarden-controller.","exploited":"There is no known exploitation of CVE-2025-24376 in the wild and no public exploit code.","fix":"Upgrade github.com/kubewarden/kubewarden-controller to 1.21.0 or later.","what":"CVE-2025-24376 is a medium-severity missing authorization vulnerability in kubewarden-controller, published on 30 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2025-24376 and fix it if it is affected.\n\nWhat it is: CVE-2025-24376 is a medium-severity missing authorization vulnerability in kubewarden-controller, published on 30 Jan 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2025-24376 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- github.com/kubewarden/kubewarden-controller (Go): affected from 1.7.0; fixed in 1.21.0\n- github.com/kubewarden/kubewarden-controller (Go): affected from 1.7.0; fixed in 1.21.0\n- github.com/kubewarden/kubewarden-controller (Go): affected from 1.7.0; fixed in 1.21.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2025-24376/ (Markdown: https://insights.sbomify.com/CVE-2025-24376/index.md)","id":"CVE-2025-24376","markdown":"https://insights.sbomify.com/CVE-2025-24376/index.md","name":"CVE-2025-24376","record":{"aliases":["GHSA-fc89-jghx-8pvg","GO-2025-3434"],"analysis":{"component_type":"container_or_infrastructure","fix_type":"upgrade","impacts":["data_modify","security_bypass"],"network_reachable":"yes","non_default_config":false,"product_category":"Kubernetes admission controller","requires_auth":"none","summary":"Attackers can manipulate PolicyReport resources via admission policies to hide non-compliant objects, requiring an upgrade to kubewarden-controller.","user_interaction":"not_required","vuln_class":"missing_authorization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[],"cvss":{"score":6.5,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L","version":"3.1"},"cwes":[{"id":"CWE-285","name":"Improper Authorization"},{"id":"CWE-155","name":"Improper Neutralization of Wildcards or Matching Symbols"}],"description":"kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and AdmissionPolicyGroup can evaluate only namespaced resources. The resources to be evaluated are determined by the rules provided by the user when defining the policy. There might be Kubernetes namespaced resources that should not be validated by AdmissionPolicy and by the AdmissionPolicyGroup policies because of their sensitive nature. For example, PolicyReport are namespaced resources that contain the list of non compliant objects found inside of a namespace. An attacker can use either an AdmissionPolicy or an AdmissionPolicyGroup to prevent the creation and update of PolicyReport objects to hide non-compliant resources. Moreover, the same attacker might use a mutating AdmissionPolicy to alter the contents of the PolicyReport created inside of the namespace. Starting from the 1.21.0 release, the validation rules applied to AdmissionPolicy and AdmissionPolicyGroup have been tightened to prevent them from validating sensitive types of namespaced resources.","ecosystems":["Go"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources","id":"CVE-2025-24376","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"Go","product":null,"products":[],"type":"missing_authorization","year":"2025"},"n_packages":3,"n_references":2,"next":{"headline":"Command injection in Unity","id":"CVE-2025-24377"},"packages":[{"ecosystem":"Go","fixed":["1.21.0"],"introduced":["1.7.0"],"last_affected":[],"package":"github.com/kubewarden/kubewarden-controller","purl":null,"source":"GHSA-fc89-jghx-8pvg"},{"ecosystem":"Go","fixed":["1.21.0"],"introduced":["1.7.0"],"last_affected":[],"package":"github.com/kubewarden/kubewarden-controller","purl":"pkg:golang/github.com/kubewarden/kubewarden-controller","source":"GHSA-fc89-jghx-8pvg"},{"ecosystem":"Go","fixed":["1.21.0"],"introduced":["1.7.0"],"last_affected":[],"package":"github.com/kubewarden/kubewarden-controller","purl":"pkg:golang/github.com/kubewarden/kubewarden-controller","source":"GO-2025-3434"}],"prev":{"headline":"MySQL K8s charm could leak credentials for root-level user `serverconfig`","id":"CVE-2025-24375"},"products":["kubewarden-controller"],"published":"2025-01-30","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"CC BY 4.0","name":"Go Vulnerability Database","prefix":"GO"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":"yes","exploitation":"none","technical_impact":"partial"},"state":"PUBLISHED","updated":"2025-02-12","vendors":["kubewarden"]},"summary":"Attackers can manipulate PolicyReport resources via admission policies to hide non-compliant objects, requiring an upgrade to kubewarden-controller.","url":"https://insights.sbomify.com/CVE-2025-24376/"}