What’s Vulnerable › Vulnerabilities

CVE-2025-64171: MARIN3R: Cross-Namespace Vulnerability in the Operator

• Severity: high (CVSS 8.7 v4.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2025-11-06 · updated 2026-06-17
• Weakness: CWE-862

Description

MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. In versions 0.13.3 and below, there is a cross-namespace secret access vulnerability in the project's DiscoveryServiceCertificate which allows users to bypass RBAC and access secrets in unauthorized namespaces. This issue is fixed in version 0.13.4.

Affected products

• 3scale-sre marin3r: before 0.13.4

References

• https://github.com/3scale-sre/marin3r/commit/859b14115fde1d67620e645cd1b62e90e30d9981
• https://github.com/3scale-sre/marin3r/security/advisories/GHSA-gf93-xccm-5g6j

Get alerted when CVE-2025-64171 or the next vulnerability affects your stack