CVE-2025-46599 json
CNCF K3s Kubernetes kubelet configuration exposes credentials
published last yr. modified last mo. also EUVD-2025-12401 , GHSA-864f-7xjm-2jp2 , GO-2025-3646
- cvss
- 6.8
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 40%
- public exploits
- 0
- none known
Summary
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.
Patch / fix
- go github.com/k3s-io/k3s 1.32.4-rc1
- K3s K3s 1.32.4-rc1+k3s
- govulncheck-vulndb openSUSE Tumbleweed 0.0.20250506T153719-1.1
opensuse advisories openSUSE-SU-2025:15059-1
Is CVE-2025-46599 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.
Check with FencerCISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- last yr.
Exploit prediction
0.46% chance of exploitation in the next 30 days, higher than 40% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CNA | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |
| GitHub | 3.1 | 6.8 | CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| go | github.com/k3s-io/k3s | >=1.32.0-rc1, <1.32.4-rc1 all versions |
1.32.4-rc1 |
Affected products
- K3s K3s
Classification
- Weakness
-
- CWE-1188 Initialization of a Resource with an Insecure Default
References
-
github.com
/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a
web, patch
-
github.com
/f1veT/BUG/issues/2
web
-
cloud.google.com
/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port
web
-
github.com
/k3s-io/k3s/issues/12164
web, report
-
github.com
/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1
web
-
nvd.nist.gov
/vuln/detail/CVE-2025-46599
advisory
-
github.com
/k3s-io/k3s
package
-
pkg.go.dev
/vuln/GO-2025-3646
web
-
github.com
/advisories/GHSA-864f-7xjm-2jp2
advisory
Sources
- CVE List CVE-2025-46599
- GitHub Advisory GHSA-864f-7xjm-2jp2
- NVD CVE-2025-46599
- OSV GO-2025-3646
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.