What’s Vulnerable › Vulnerabilities

CVE-2025-64434: KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing

• Severity: medium (CVSS 6.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.2% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2025-11-07 · updated 2026-06-17
• Weakness: CWE-287

Description

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.

Affected products

• kubevirt: before 1.5.3; 1.6.0 — fixed in 1.5.3

How to fix

Upgrade to a fixed version: kubevirt 1.5.3. Check the vendor advisory for mitigations.

References

• https://github.com/kubevirt/kubevirt/commit/231dc69723f331dc02f65a31ab4c3d6869f40d6a
• https://github.com/kubevirt/kubevirt/commit/af2f08a9a186eccc650f87c30ab3e07b669e8b5b
• https://github.com/kubevirt/kubevirt/commit/b9773bc588e6e18ece896a2dad5336ef7a653074
• https://github.com/kubevirt/kubevirt/security/advisories/GHSA-ggp9-c99x-54gp

Get alerted when CVE-2025-64434 or the next vulnerability affects your stack