CVE-2025-64436 - CVE House
Back to Database
Status published Medium CVE-2025-64436

KubeVirt Excessive Role Permissions Could Enable Unauthorized VMI Migrations Between Nodes

Vulnerability Description

KubeVirt is a virtual machine management add-on for Kubernetes. In 1.5.0 and earlier, the permissions granted to the virt-handler service account, such as the ability to update VMI and patch nodes, could be abused to force a VMI migration to an attacker-controlled node. This vulnerability could otherwise allow an attacker to mark all nodes as unschedulable, potentially forcing the migration or creation of privileged pods onto a compromised node.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2025-64436

Credits & Attribution

No credits recorded in the NVD database.

References

More from kubevirt

View All →
CVE-2025-64437
KubeVirt Isolation Detection Flaw Allows Arbitrary File Permission Changes
Medium 5
CVE-2025-64435
KubeVirt VMI Denial-of-Service (DoS) Using Pod Impersonation
Medium 5.3
CVE-2025-64434
KubeVirt Improper TLS Certificate Management Handling Allows API Identity Spoofing
Medium 4.7
CVE-2025-64433
KubeVirt Arbitrary Container File Read
Medium 6.5
CVE-2025-64432
KubeVirt Affected by an Authentication Bypass in Kubernetes Aggregation Layer
Medium 4.7

Affected Vendor

Affected Software

kubevirt
Vulnerable Versions:
<= 1.5.0

Timeline

Official Publish: November 7th, 2025
Last Modified: November 10th, 2025
Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

CWE-269 CWE-276

MITRE ATT&CK TTPs

T1078 Valid Accounts
Persistence
T1098 Account Manipulation
Privilege Escalation
T1548 Abuse Elevation Control Mechanism
Privilege Escalation
T1222 File and Directory Permissions Modification
Defense Evasion
T1134 Access Token Manipulation
Defense Evasion
T1574 Hijack Execution Flow
Privilege Escalation
T1021 Remote Services
Lateral Movement
T1005 Data from Local System
Collection