CVE-2025-64432

KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.

• CWE-287
• CWE-295

• https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6aPatch
• https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5bPatch
• https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074Patch
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-38jw-g2qx-4286Exploit, Vendor Advisory

Published

Nov 7, 2025

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2025-64427ZimaOS is a fork of CasaOS, an operating system for Zima dev…6.5
• CVE-2025-64428Dataease is an open source data visualization analysis tool.…9.8
• CVE-2025-64429DuckDB is a SQL database management system. DuckDB implement…6.5
• CVE-2025-6443Mikrotik RouterOS VXLAN Source IP Improper Access Control Vu…7.2
• CVE-2025-64430Parse Server is an open source backend that can be deployed …7.5
• CVE-2025-64431Zitadel is an open source identity management platform. Vers…8.7
• CVE-2025-64433KubeVirt is a virtual machine management add-on for Kubernet…6.5
• CVE-2025-64434KubeVirt is a virtual machine management add-on for Kubernet…6.3
• CVE-2025-64435KubeVirt is a virtual machine management add-on for Kubernet…5.3
• CVE-2025-64436KubeVirt is a virtual machine management add-on for Kubernet…5.3
• CVE-2025-64437KubeVirt is a virtual machine management add-on for Kubernet…5
• CVE-2025-64438Fast DDS is a C++ implementation of the DDS (Data Distributi…7.5