CVE-2025-64434 - CVE House
Back to Database
Status published Medium CVE-2025-64434

KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing

Vulnerability Description

KubeVirt is a virtual machine management add-on for Kubernetes. Prior to 1.5.3 and 1.6.1, due to the peer verification logic in virt-handler (via verifyPeerCert), an attacker who compromises a virt-handler instance, could exploit these shared credentials to impersonate virt-api and execute privileged operations against other virt-handler instances potentially compromising the integrity and availability of the VM managed by it. This vulnerability is fixed in 1.5.3 and 1.6.1.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64434

Credits & Attribution

No credits recorded in the NVD database.

References

More from kubevirt

View All →
CVE-2025-64437
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
Medium 5
CVE-2025-64436
KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes
Medium 6.9
CVE-2025-64435
KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation
Medium 5.3
CVE-2025-64433
KubeVirt Arbitrary Container File Read
Medium 6.5
CVE-2025-64432
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
Medium 4.7

Affected Vendor

Affected Software

kubevirt
Vulnerable Versions:
< 1.5.3, >= 1.6.0-alpha.0, < 1.6.1

Timeline

Official Publish: November 7th, 2025
Last Modified: November 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

V3: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Weaknesses (CWE)

CWE-287

MITRE ATT&CK TTPs

T1190 Exploit Public-Facing Application
Initial Access
T1078 Valid Accounts
Persistence
T1556 Modify Authentication Process
Credential Access