CVE-2025-48710 kro Confused Deputy vulnerability
Attackers with resource creation permissions can deploy malicious container images, leading to remote code execution on cluster nodes.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-48710?
CVE-2025-48710 is a medium-severity code injection vulnerability in kro.run kro, published on 4 Jun 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.
Weakness: CWE-441
Which versions are affected by CVE-2025-48710?
3 open source packages ship an affected version, including github.com/kro-run/kro.
| Package | Affected | Fixed in |
|---|---|---|
github.com/kro-run/kro Go | All versions | 0.2.1 |
github.com/kro-run/kro Go | From 0.1.0 | 0.2.1 |
github.com/kro-run/kro Go | From 0.1.0 | 0.2.1 |
How do I fix CVE-2025-48710?
Upgrade github.com/kro-run/kro to 0.2.1 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2025-48710 being exploited?
There is no known exploitation of CVE-2025-48710 in the wild and no public exploit code.
Sources
Also known as GHSA-7633-x85h-5mqh, GO-2025-3741.