CVE-2025-46599 json
CNCF K3s Kubernetes kubelet configuration exposes credentials
published 2025-04-25 18 mo ago modified 2026-09-10 1 mo ago also EUVD-2025-12401 , GHSA-864f-7xjm-2jp2 , GO-2025-3646
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.
Patch / fix
- go github.com/k3s-io/k3s 1.32.4-rc1
- K3s K3s 1.32.4-rc1+k3s
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250506T153719-1.1
opensuse advisories openSUSE-SU-2025:15059-1
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 18 mo ago
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/k3s-io/k3s | >=1.32.0-rc1, <1.32.4-rc1 all versions |
1.32.4-rc1 |
Affected products
- K3s K3s
Classification
- Weakness
-
- CWE-1188 Initialization of a Resource with an Insecure Default
References
-
github.com
/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a
web, patch
-
github.com
/f1veT/BUG/issues/2
web
-
cloud.google.com
/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port
web
-
github.com
/k3s-io/k3s/issues/12164
web, report
-
github.com
/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-46599
advisory
-
github.com
/k3s-io/k3s
package
-
pkg.go.dev
/vuln/GO-2025-3646
web
-
github.com
/advisories/GHSA-864f-7xjm-2jp2
advisory
Sources
- CVE List CVE-2025-46599
- GitHub Advisory GHSA-864f-7xjm-2jp2
- NVD CVE-2025-46599
- OSV GO-2025-3646
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.