CVE-2025-48710

Severity: medium (CVSS 4.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-06-04 · updated 2026-06-17
Weakness: CWE-441

Description

kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.

Affected products

kro.run kro: from 0.1.0 before 0.2.1 — fixed in 0.2.1

How to fix

Upgrade to a fixed version: kro.run kro 0.2.1. Check the vendor advisory for mitigations.

References

https://github.com/kro-run/kro/compare/v0.2.1...v0.2.2
https://orca.security/resources/blog/kubernetes-crd-abstraction-risks-kro/

Get alerted when CVE-2025-48710 or the next vulnerability affects your stack