kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to…
Priority LOW 19CWE-441Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · Low · None
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.
Summary
kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00402 34th percentileScored 2026-11-07
Fix Fixed kro (kro.run): 0.2.1github.com/kro-run/kro (Go): 0.2.1
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| kro.run | kro | 0.1.0 to before 0.2.1 | 0.2.1 | Patch available | CNA |
| — | github.com/kro-run/kro (Go) | 0.1.0 to before 0.2.1 | 0.2.1 | Patch available | GHSA-7633-x85h-5mqh |
- kro Vendorkro.run Affected 0.1.0 to before 0.2.1 Fixed in 0.2.1 Patch available CNA
- github.com/kro-run/kro (Go) Vendor— Affected 0.1.0 to before 0.2.1 Fixed in 0.2.1 Patch available GHSA-7633-x85h-5mqh
Remediation
- Fix · CNA kro (kro.run) Fixed in 0.2.1
- Fix · GHSA-7633-x85h-5mqh github.com/kro-run/kro (Go) Fixed in 0.2.1 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2025-48710
- 2026-10-03 Alias added: GHSA-7633-x85h-5mqh
References
Sources
- CVE-2025-48710 · CVE Program
- CVE-2025-48710 · NVD
- FIRST EPSS
- GHSA-7633-x85h-5mqh · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences