CVE-2025-64432 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
Attackers can bypass RBAC controls in KubeVirt by exploiting flawed mTLS authentication in the virt-api component, allowing unauthorized access to aggregated APIs.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64432?
CVE-2025-64432 is a medium-severity authentication bypass vulnerability in kubevirt, published on 7 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.
Which versions are affected by CVE-2025-64432?
7 open source packages ship an affected version, including kubevirt.io/kubevirt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kubevirt.io/kubevirt Go | All versions | 1.5.3, 1.6.0-beta.0.0.20250730135146-231dc69723f3, 1.6.1, 1.7.0-rc.0 |
kubevirt.io/kubevirt Go | All versions | 1.5.3 |
kubevirt.io/kubevirt Go | All versions | 1.5.3 |
kubevirt.io/kubevirt Go | From 1.6.0-alpha.0 | 1.6.1 |
kubevirt.io/kubevirt Go | From 1.6.0-alpha.0 | 1.6.1 |
kubevirt.io/kubevirt Go | From 1.7.0-alpha.0 | 1.7.0-rc.0 |
1 more packages
kubevirt.io/kubevirt Go | From 1.7.0-alpha.0 | 1.7.0-rc.0 |
Products include Kubevirt Kubevirt.
How do I fix CVE-2025-64432?
Upgrade kubevirt.io/kubevirt to a fixed version for your release line: 1.5.3, 1.6.0-beta.0.0.20250730135146-231dc69723f3, 1.6.1 or 1.7.0-rc.0.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-64432 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64432 exists.
Other vulnerabilities in kubevirt
- CVE-2020-14316 Privilege Escalation in kubevirt
- CVE-2022-1798 Path Traversal vulnerability in Kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write
- CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
- CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
Sources
Also known as AZL-69793, AZL-69890, GHSA-38jw-g2qx-4286, GO-2025-4103, MINI-49qg-h42q-vqwf, MINI-5gh3-mc22-wrc6 and 2 more.