CVE-2025-64434 KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing
An attacker compromising a virt-handler instance can impersonate virt-api to execute privileged operations against other handlers, compromising VM integrity.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-64434?
CVE-2025-64434 is a medium-severity authentication bypass vulnerability in kubevirt, published on 7 Nov 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.
Weakness: CWE-287
Which versions are affected by CVE-2025-64434?
5 open source packages ship an affected version, including kubevirt.io/kubevirt. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
kubevirt.io/kubevirt Go | All versions | 1.5.3, 1.6.0-beta.0.0.20250730135146-231dc69723f3, 1.6.1 |
kubevirt.io/kubevirt Go | All versions | 1.5.3 |
kubevirt.io/kubevirt Go | All versions | 1.5.3 |
kubevirt.io/kubevirt Go | From 1.6.0-alpha.0 | 1.6.1 |
kubevirt.io/kubevirt Go | From 1.6.0-alpha.0 | 1.6.1 |
Products include Kubevirt Kubevirt.
How do I fix CVE-2025-64434?
Upgrade kubevirt.io/kubevirt to a fixed version for your release line: 1.5.3, 1.6.0-beta.0.0.20250730135146-231dc69723f3 or 1.6.1.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2025-64434 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2025-64434 exists.
Other vulnerabilities in kubevirt
- CVE-2020-14316 Privilege Escalation in kubevirt
- CVE-2022-1798 Path Traversal vulnerability in Kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write
- CVE-2023-26484 On a compromised KubeVirt node, the virt-handler service account can be used to modify all node specs
- CVE-2026-13201 Path traversal in Red Hat Container Native Virtualization 4.12
Sources
Also known as AZL-69796, AZL-69961, GHSA-ggp9-c99x-54gp, GO-2025-4107, MINI-6288-xgq5-xxqp, MINI-qv6q-2w3m-h2r3.