KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0 contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN (Common Name) field in the received client TLS certificates against the set of allowed values defined in the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is fixed in versions 1.5.3 and 1.6.1.

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:20281-1 advisory.

    Update to version 1.7.0 (bsc#1257128).

    Security issues fixed:

      - CVE-2025-64435: logic flaw in the virt-controller can lead to incorrect status updates and potentially     causing a DoS         (bsc#1253189).
      - CVE-2024-45310: kubevirt vendored github.com/opencontainers/runc/libcontainer/utils: runc can be     tricked into         creating empty files/directories on host (bsc#1257422).
      - CVE-2025-22872: incorrectly interpreted tags can cause content to be placed wrong scope during DOM     construction         (bsc#1241772).
      - CVE-2025-64432: fail to correctly validate certain fields in the client TLS certificate may allow an     attacker to         bypass existing RBAC controls (bsc#1253181).
      - CVE-2025-64433: improper symlink handling can allow to read arbitrary files (bsc#1253185).
      - CVE-2025-64434: compromising virt-handler instance can lead to impersonate virt-api and execute     privileged operations         (bsc#1253186).
      - CVE-2025-64437: mishandling of symlinks can lead to compromising the CIA (bsc#1253194).
      - CVE-2025-64324: a logic bug that allows an attacker to read and write arbitrary files owned by more     privileged users         (bsc#1253748).

    Other updates and bugfixes:

      - Upstream now uses stateless firmware for CoCo VMs.

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:4330-1 advisory.

    Updated kubevirt to version 1.6.3:

      - CVE-2025-22872: Fixed incorrect interpretation of tags leading content to be placed wrong scope during     DOM         construction in golang.org/x/net/html (bsc#1241772)
      - CVE-2025-64432: Fixed bypass of RBAC controls due to incorrect validation of certain fields in the     client         TLS certificate (bsc#1253181)
      - CVE-2025-64433: Fixed arbitrary files read via improper symlink handling (bsc#1253185)
      - CVE-2025-64434: Fixed privilege escalation via virt-api impersonification due to compromise virt-     handler         instance (bsc#1253186)
      - CVE-2025-64437: Fixed mishandling of symlinks (bsc#1253194)
      - CVE-2025-64324: Fixed a logic bug that allows an attacker to read and write arbitrary files owned by     more         privileged users (bsc#1253748)

Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - KubeVirt is a virtual machine management add-on for Kubernetes. Versions 1.5.3 and below, and 1.6.0
    contained a flawed implementation of the Kubernetes aggregation layer's authentication flow which could
    enable bypass of RBAC controls. It was discovered that the virt-api component fails to correctly
    authenticate the client when receiving API requests over mTLS. In particular, it fails to validate the CN
    (Common Name) field in the received client TLS certificates against the set of allowed values defined in
    the extension-apiserver-authentication configmap. Failre to validate certain fields in the client TLS
    certificate may allow an attacker to bypass existing RBAC controls by directly communicating with the
    aggregated API server, impersonating the Kubernetes API server and its aggregator component. This issue is
    fixed in versions 1.5.3 and 1.6.1. (CVE-2025-64432)

ID	Name	Product	Family	Severity
300617	openSUSE 16 Security Update : kubevirt (openSUSE-SU-2026:20281-1)	Nessus	SuSE Local Security Checks	high
278074	SUSE SLES15 Security Update : kubevirt, virt-api-container, virt-controller-container, virt-exportproxy-container, virt-exportserver-container, virt-handler-container, virt-launcher-container, virt-libguestfs-tools-container, virt-operator-container, virt-pr-helper-container (SUSE-SU-2025:4330-1)	Nessus	SuSE Local Security Checks	high
435958	SCA: security update for kubevirt.io/kubevirt (GHSA-38jw-g2qx-4286)	Tenable Cloud Security	SCA Checks	medium
435958	SCA: security update for kubevirt.io/kubevirt (GHSA-38jw-g2qx-4286)	Tenable Self-Hosted Container Security	SCA Checks	medium

Detections

Analytics

CVE-2025-64432

medium

Tenable Plugins

high

high

medium

medium