CVE-2025-46599: CNCF K3s Kubernetes kubelet configuration exposes credentials
(updated )
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.
References
- cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port
- github.com/advisories/GHSA-864f-7xjm-2jp2
- github.com/f1veT/BUG/issues/2
- github.com/k3s-io/k3s
- github.com/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a
- github.com/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1
- github.com/k3s-io/k3s/issues/12164
- nvd.nist.gov/vuln/detail/CVE-2025-46599
- pkg.go.dev/vuln/GO-2025-3646
Code Behaviors & Features
Detect and mitigate CVE-2025-46599 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →