CVE-2025-61779CWE-639

CVE-2025-61779

published October 10, 2025

CVSS
8.7
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.

The record
Technical detail
CVSS
8.7 · NONE
CVSS v4.0
Not supplied
EPSS
0.00447 · 37.9th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2025-10-10T01:15Z
References (4)
https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0 · [email protected]https://github.com/confidential-containers/trustee/pull/957 · [email protected]https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x · [email protected]https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x · 134c704f-9b21-4f2e-91b3-4a467353bcc0
EPSS history
Timeline
  • 09 OCT 20:53Z
    Trustee's attestation-policy endpoint is not protected by admin autentication
    cvelistv5