Vulnetix
Try Vulnetix Request Demo
CVE-2025-48710 PUBLISHED CVSS 4.099999904632568 MEDIUM

kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.

EPSS 0.28% · 51.0th percentile

Risk Scores

CVSS v3.1
4.099999904632568
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N
EPSS Score
0.28%
51.0th percentile

Affected Products

VendorProductVersions
kro.runkro0.1.0, 0.1.0
github.comkro-run/kro0.1.0, 0.1.0

Timeline

References

Open in Interactive Console →