CVE-2025-48710: kro Confused Deputy vulnerability

June 4, 2025 (updated June 5, 2025)

kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro’s controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.

References

github.com/advisories/GHSA-7633-x85h-5mqh
github.com/kro-run/kro
github.com/kro-run/kro/compare/v0.2.1...v0.2.2
nvd.nist.gov/vuln/detail/CVE-2025-48710
orca.security/resources/blog/kubernetes-crd-abstraction-risks-kro

Code Behaviors & Features

Detect and mitigate CVE-2025-48710 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →