CVE-2025-64171 MARIN3R: Cross-Namespace Vulnerability in the Operator
Attackers can bypass RBAC to access secrets in unauthorized namespaces via the DiscoveryServiceCertificate resource in the MARIN3R operator.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64171?
CVE-2025-64171 is a high-severity missing authorization vulnerability in 3scale-sre marin3r, published on 6 Nov 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is fixed in version 0.13.4.
Weakness: CWE-862
Which versions are affected by CVE-2025-64171?
3 open source packages ship an affected version, including github.com/3scale-sre/marin3r.
| Package | Affected | Fixed in |
|---|---|---|
github.com/3scale-sre/marin3r Go | All versions | 0.13.4 |
github.com/3scale-sre/marin3r Go | All versions | 0.13.4 |
github.com/3scale-sre/marin3r Go | All versions | 0.13.4 |
How do I fix CVE-2025-64171?
Upgrade github.com/3scale-sre/marin3r to 0.13.4 or later.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-64171 being exploited?
There is no known exploitation of CVE-2025-64171 in the wild and no public exploit code.
Sources
Also known as GHSA-gf93-xccm-5g6j, GO-2025-4093.