Kubernetes Controller Vulnerability in Kubewarden by Kubewarden
CVE-2025-24784

4.3MEDIUM

Key Information:

Vendor

Kubewarden

Status
Kubewarden-controller
Vendor
CVE Published:
30 January 2025

What is CVE-2025-24784?

The kubewarden-controller is a Kubernetes controller designed for dynamic registration of Kubewarden admission policies. The introduction of the policy group feature in version 1.17.0 allows non-admin users to manage these resources within their namespaces. However, the context-aware policies, which can access the Kubernetes API at evaluation time, may inadvertently expose sensitive resource information to attackers. This occurs when an attacker exploits a higher access level granted to the ServiceAccount token utilized by the Policy Server, leading to potential unauthorized access to cluster resources. The severity of this vulnerability is contingent on the privileges assigned to the ServiceAccount and adherence to best practices for least privilege management. This issue has been addressed in version 1.21.0.

Affected Version(s)

kubewarden-controller >= 1.17.0, < 1.21.0

References

https://github.com/kubewarden/kubewarden-controller/secur...
x_refsource_CONFIRM
https://github.com/kubewarden/kubewarden-controller/commi...
x_refsource_MISC

CVSS V3.1

Score:
4.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.