CVE-2025-46599 CNCF K3s Kubernetes kubelet configuration exposes credentials
Unauthenticated access to the kubelet ReadOnlyPort in K3s exposes credentials, requiring an upgrade to secure the configuration.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-46599?
CVE-2025-46599 is a medium-severity vulnerability in K3s, published on 25 Apr 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.
Weakness: CWE-1188
Which versions are affected by CVE-2025-46599?
3 open source packages ship an affected version, including github.com/k3s-io/k3s.
| Package | Affected | Fixed in |
|---|---|---|
github.com/k3s-io/k3s Go | All versions | None |
github.com/k3s-io/k3s Go | From 1.32.0-rc1 | 1.32.4-rc1 |
github.com/k3s-io/k3s Go | From 1.32.0-rc1 | 1.32.4-rc1 |
How do I fix CVE-2025-46599?
Upgrade github.com/k3s-io/k3s to 1.32.4-rc1 or later.
Is CVE-2025-46599 being exploited?
There is no known exploitation of CVE-2025-46599 in the wild and no public exploit code.
Sources
Also known as GHSA-864f-7xjm-2jp2, GO-2025-3646.