CVE-2025-48710CWE-441

kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary…

Medium · published June 4, 2025

CVSS v3.1
4.1
EPSS
0%
Percentile
30.2
In the wild
Unconfirmed
What it is

kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.

The record
Technical detail
CVSS v3.1
4.1 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00375 · 30.2th percentile
Weakness
CWE-441 · Unintended Proxy or Intermediary ('Confused Deputy')
Published
2025-06-04T05:50Z
EPSS history
Timeline
  • 04 JUN 05:50Z
    kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary…
    cvelistv5