Peer Verification Bypass in KubeVirt Affecting Kubernetes Management
CVE-2025-64434

4.7MEDIUM

Key Information:

Vendor

Kubevirt

Status
Kubevirt
Vendor
CVE Published:
7 November 2025

What is CVE-2025-64434?

KubeVirt, a virtual machine management add-on for Kubernetes, has a vulnerability where improper peer verification logic in virt-handler can be exploited. An attacker who gains control over a virt-handler instance can leverage shared credentials to impersonate virt-api. This may lead to unauthorized privileged operations against other virt-handler instances, endangering the integrity and availability of the managed VMs. To mitigate this risk, users are required to upgrade to KubeVirt versions 1.5.3 or 1.6.1 and above.

Affected Version(s)

kubevirt < 1.5.3 < 1.5.3

kubevirt >= 1.6.0-alpha.0, < 1.6.1 < 1.6.0-alpha.0, 1.6.1

References

https://github.com/kubevirt/kubevirt/security/advisories/...
x_refsource_CONFIRM
https://github.com/kubevirt/kubevirt/commit/231dc69723f33...
x_refsource_MISC
https://github.com/kubevirt/kubevirt/commit/af2f08a9a186e...
x_refsource_MISC

CVSS V3.1

Score:
4.7
Severity:
MEDIUM
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.
CVE-2025-64434 : Peer Verification Bypass in KubeVirt Affecting Kubernetes Management