CVE-2025-64432
📋 TL;DR
This vulnerability in KubeVirt allows attackers to bypass RBAC controls by exploiting a flawed mTLS authentication implementation in the virt-api component. Attackers can impersonate the Kubernetes API server to gain unauthorized access to the aggregated API server. Users running KubeVirt versions 1.5.3 and below, or version 1.6.0 are affected.
💻 Affected Systems
- KubeVirt
📦 What is this software?
Kubevirt by Kubevirt
Kubevirt by Kubevirt
Kubevirt by Kubevirt
Kubevirt by Kubevirt
⚠️ Risk & Real-World Impact
Worst Case
Complete cluster compromise through unauthorized access to virtual machine management APIs, potentially leading to data exfiltration, VM manipulation, or lateral movement within the Kubernetes environment.
Likely Case
Unauthorized access to KubeVirt APIs allowing attackers to view, modify, or delete virtual machine resources within the affected namespace.
If Mitigated
Limited impact with proper network segmentation and strict RBAC policies, though authentication bypass remains possible.
🎯 Exploit Status
Exploitation requires internal network access and knowledge of the Kubernetes cluster structure, but no authentication is needed once network access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Versions 1.5.3 and 1.6.1
Vendor Advisory: https://github.com/kubevirt/kubevirt/security/advisories/GHSA-38jw-g2qx-4286
Restart Required: Yes
Instructions:
1. Upgrade KubeVirt to version 1.5.3 or 1.6.1. 2. Update the KubeVirt CRD: kubectl apply -f https://github.com/kubevirt/kubevirt/releases/download/v1.5.3/kubevirt-operator.yaml (or v1.6.1). 3. Restart the virt-api pods: kubectl delete pods -n kubevirt -l kubevirt.io=virt-api.
🔧 Temporary Workarounds
Network Policy Restriction
linuxRestrict network access to virt-api pods using Kubernetes Network Policies
kubectl apply -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: restrict-virt-api
namespace: kubevirt
spec:
podSelector:
matchLabels:
kubevirt.io: virt-api
policyTypes:
- Ingress
ingress:
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
ports:
- protocol: TCP
port: 443
EOF
🧯 If You Can't Patch
- Implement strict network segmentation to isolate virt-api pods from untrusted networks
- Enhance monitoring and alerting for unauthorized access attempts to virt-api endpoints
🔍 How to Verify
Check if Vulnerable:
Check KubeVirt version: kubectl get kubevirt.kubevirt.io/kubevirt -n kubevirt -o jsonpath='{.status.observedKubeVirtVersion}'Check Version:
kubectl get kubevirt.kubevirt.io/kubevirt -n kubevirt -o jsonpath='{.status.observedKubeVirtVersion}'Verify Fix Applied:
Verify version is 1.5.3 or 1.6.1 and check virt-api pod logs for successful TLS handshake validation📡 Detection & Monitoring
Log Indicators:
- Failed TLS certificate validation in virt-api logs
- Unauthorized API requests to virt-api endpoints
- Unexpected client certificate CN values in authentication logs
Network Indicators:
- Unusual traffic patterns to virt-api pods from non-Kubernetes system components
- Direct connections to virt-api bypassing the Kubernetes API server
SIEM Query:
source="kubevirt" "virt-api" AND ("authentication failed" OR "certificate validation error" OR "unauthorized request")🔗 References
- https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a
- https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b
- https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074
- https://github.com/kubevirt/kubevirt/security/advisories/GHSA-38jw-g2qx-4286
