« Volver al listado

CVE-2025-46599

Estado: AplazadaMedia (6.8)—

CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Cncf — K3SAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-46599",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-46599",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-04-25T14:27:58.783975Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "cve@mitre.org",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.8,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "K3s",
          "product": "K3s",
          "versions": [
            {
              "status": "affected",
              "version": "1.32",
              "lessThan": "1.32.4-rc1+k3s",
              "versionType": "custom"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-04-25T05:15:33.330",
  "references": [
    {
      "url": "https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/f1veT/BUG/issues/2",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://github.com/k3s-io/k3s/issues/12164",
      "source": "cve@mitre.org"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "cve@mitre.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-1188"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials."
    },
    {
      "lang": "es",
      "value": "CNCF K3s 1.32 anterior a 1.32.4-rc1+k3s1 tiene un cambio de configuración de kubelet de Kubernetes con la consecuencia no deseada de que, en algunas situaciones, ReadOnlyPort se establece en 10255. Por ejemplo, el comportamiento predeterminado de una instalación en línea de K3s podría permitir el acceso no autenticado a este puerto, exponiendo las credenciales."
    }
  ],
  "lastModified": "2026-06-17T09:26:41.557",
  "sourceIdentifier": "cve@mitre.org"
}