CVE-2025-64434
Medium · 4.7KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing
CVSS
4.7
EPSS
0.2%
Published
Nov 6, 2025
CISA due date
—
The record
Due to improper TLS certificate management, a compromised `virt-handler` could impersonate `virt-api` by using its own TLS credentials, allowing it to initiate privileged operations against another `virt-handler`.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | kubevirt.io/kubevirt | 0 | 1.5.3 |
| Go | kubevirt.io/kubevirt | 1.6.0-alpha.0 | 1.6.0-beta.0.0.20250730135146-231dc69723f3 |
| Go | kubevirt.io/kubevirt | 1.6.0-alpha.0 | 1.6.1 |
| Go | kubevirt.io/kubevirt | 1.6.0-rc.0 | 1.6.1 |
| Chainguard | docker-machine-driver-harvester | 0 | 1.0.5-r0 |
| Wolfi | docker-machine-driver-harvester | 0 | 1.0.5-r0 |
| go | kubevirt.io/kubevirt | 1.6.0-alpha.0 | 1.6.1 |
| go | kubevirt.io/kubevirt | 1.6.0-rc.0 | 1.6.1 |
| openSUSE:Leap 16.0 | kubevirt | 0 | 1.7.0-160000.1.1 |
Related vulnerabilities
- GO-2026-4384 KubeVirt Guest Agent DoS via Excessive Network Interface Reports in kubevirt.io/kubevirt Also affects kubevirt.io/kubevirt
- CVE-2025-14525 A flaw was found in kubevirt. Also affects kubevirt.io/kubevirt
- GO-2025-4105 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation in kubevirt.io/kubevirt Also affects kubevirt.io/kubevirt
- GO-2025-4104 KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between… Also affects kubevirt.io/kubevirt
- CVE-2025-64432 KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer Also affects kubevirt.io/kubevirt
- CVE-2025-64324 KubeVirt Vulnerable to Arbitrary Host File Read and Write Also affects kubevirt.io/kubevirt
- CVE-2025-64433 KubeVirt Arbitrary Container File Read Also affects kubevirt.io/kubevirt
- CVE-2025-64435 KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation Also affects kubevirt.io/kubevirt