Skip to content
Fencer Vulns
medium 6.5

CVE-2025-24376 json

The kubewarden-controller AdmissionPolicy and AdmissionPolicyGroup policies can be used to alter PolicyReport resources

published 2025-01-30 21 mo ago modified 2026-06-17 4 mo ago also EUVD-2025-0156 , GHSA-fc89-jghx-8pvg , GO-2025-3434

cvss
6.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.3%
EPSS 0.3% chance of exploitation in 30 days, percentile 28%
public exploits
0
none known

Summary

kubewarden-controller is a Kubernetes controller that allows you to dynamically register Kubewarden admission policies. By design, AdmissionPolicy and AdmissionPolicyGroup can evaluate only namespaced resources. The resources to be evaluated are determined by the rules provided by the user when defining the policy. There might be Kubernetes namespaced resources that should not be validated by AdmissionPolicy and by the AdmissionPolicyGroup policies because of their sensitive nature. For example, PolicyReport are namespaced resources that contain the list of non compliant objects found inside of a namespace. An attacker can use either an AdmissionPolicy or an AdmissionPolicyGroup to prevent the creation and update of PolicyReport objects to hide non-compliant resources. Moreover, the same attacker might use a mutating AdmissionPolicy to alter the contents of the PolicyReport created inside of the namespace. Starting from the 1.21.0 release, the validation rules applied to AdmissionPolicy and AdmissionPolicyGroup have been tightened to prevent them from validating sensitive types of namespaced resources.

Patch / fix

  • go github.com/kubewarden/kubewarden-controller 1.21.0
  • linuxfoundation kubewarden 1.21.0
  • govulncheck-vulndb SLE Module for Package Hub 15 SP6, openSUSE Leap 15.6 0.0.20250207T224745-150000.1.32.1

suse advisories SUSE-SU-2025:0429-1

  • govulncheck-vulndb openSUSE Tumbleweed 0.0.20250204T220613-1.1

opensuse advisories openSUSE-SU-2025:14732-1

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
21 mo ago

Exploit prediction

0.34% chance of exploitation in the next 30 days, higher than 28% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
GitHub 3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L

Affected packages

ecosystem package affected fixed in
go github.com/kubewarden/kubewarden-controller
>=1.7.0, <1.21.0
1.21.0

Affected products

  • kubewarden kubewarden-controller

Classification

Weakness
  • CWE-285 Improper Authorization
  • CWE-155 Improper Neutralization of Wildcards or Matching Symbols

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.