CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with…
Priority LOW 30CWE-1188Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- High
- Impact type
- —
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00459 39th percentileScored 2026-11-07
Fix Fixed K3s (K3s): 1.32.4-rc1+k3sgithub.com/k3s-io/k3s (Go): 1.32.4-rc1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| K3s | K3s | 1.32 to before 1.32.4-rc1+k3s | 1.32.4-rc1+k3s | Patch available | CNA |
| — | github.com/k3s-io/k3s (Go) | 1.32.0-rc1 to before 1.32.4-rc1 | 1.32.4-rc1 | Patch available | GHSA-864f-7xjm-2jp2 |
- K3s VendorK3s Affected 1.32 to before 1.32.4-rc1+k3s Fixed in 1.32.4-rc1+k3s Patch available CNA
- github.com/k3s-io/k3s (Go) Vendor— Affected 1.32.0-rc1 to before 1.32.4-rc1 Fixed in 1.32.4-rc1 Patch available GHSA-864f-7xjm-2jp2
Remediation
- Fix · CNA K3s (K3s) Fixed in 1.32.4-rc1+k3s
- Fix · GHSA-864f-7xjm-2jp2 github.com/k3s-io/k3s (Go) Fixed in 1.32.4-rc1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-46599
- 2026-10-03 Alias added: GHSA-864f-7xjm-2jp2
References
Other 7
- https://github.com/f1veT/BUG/issues/2
- https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port
- https://github.com/k3s-io/k3s/issues/12164
- https://github.com/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a
- https://github.com/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1
- https://github.com/k3s-io/k3s
- https://pkg.go.dev/vuln/GO-2025-3646
More K3s vulnerabilities
- TI-2023-15488 Resource allocation without limits in SUSE k3s CVSS 3.1HIGH 7.5
Sources
- CVE-2025-46599 · CVE Program
- CVE-2025-46599 · NVD
- FIRST EPSS
- GHSA-864f-7xjm-2jp2 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences