Kubernetes Controller Vulnerability in Kubewarden by Kubewarden
CVE-2025-24376

6.5MEDIUM

Key Information:

Vendor

Kubewarden

Status
Kubewarden-controller
Vendor
CVE Published:
30 January 2025

What is CVE-2025-24376?

The kubewarden-controller, responsible for dynamically managing admission policies in Kubernetes, is susceptible to a vulnerability that allows attackers to bypass policy validations. This can lead to sensitive namespaced resources, such as PolicyReports, not being validated as intended. An attacker could leverage AdmissionPolicy and AdmissionPolicyGroup to block the creation or update of PolicyReport objects, thereby concealing non-compliant Kubernetes resources. Additionally, with a mutating AdmissionPolicy, they could modify the contents of the PolicyReport, escalating the risk of hiding critical compliance violations. This issue emphasizes the need for stricter adherence to validation rules starting from version 1.21.0.

Affected Version(s)

kubewarden-controller >= 1.7.0, < 1.21.0

References

https://github.com/kubewarden/kubewarden-controller/secur...
x_refsource_CONFIRM
https://github.com/kubewarden/kubewarden-controller/commi...
x_refsource_MISC

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.