CVE-2025-32963
Last modified
CVE-2025-32963 is a medium-severity vulnerability rated 6.9/10 on the CVSS scale. MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. EPSS estimates a 0.54% chance of exploitation in the next 30 days.
Description
MinIO Operator STS is a native IAM Authentication for Kubernetes. Prior to version 7.1.0, if no audiences are provided for the `spec.audiences` field, the default will be of the Kubernetes apiserver. Without scoping, it can be replayed to other internal systems, which may unintentionally trust it. This issue has been patched in version 7.1.0.
Metrics
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness Enumeration
References
Timeline
- Published
- Last Modified
- Status
- Deferred
Frequently Asked Questions
What is CVE-2025-32963?
How severe is CVE-2025-32963?
How do I fix CVE-2025-32963?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2025
- CVE-2025-32958Adept is a language for general purpose programming. Prior t…9.8
- CVE-2025-32959CUBA Platform is a high level framework for enterprise appli…6.5
- CVE-2025-3296A vulnerability, which was classified as critical, has been …6.3
- CVE-2025-32960The CUBA REST API add-on performs operations on data and ent…6.4
- CVE-2025-32961The Cuba JPA web API enables loading and saving any entities…6.4
- CVE-2025-32962Flask-AppBuilder is an application development framework bui…6.1
- CVE-2025-32964ManageWiki is a MediaWiki extension allowing users to manage…4.6
- CVE-2025-32965xrpl.js is a JavaScript/TypeScript API for interacting with …9.3
- CVE-2025-32966DataEase is an open-source BI tool alternative to Tableau. P…9.8
- CVE-2025-32967OpenEMR is a free and open source electronic health records …5.4
- CVE-2025-32968XWiki is a generic wiki platform. In versions starting from …8.8
- CVE-2025-32969XWiki is a generic wiki platform. In versions starting from …9.8
Are you affected by CVE-2025-32963?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST