CVE-2025-46599

Name of the Vulnerable Software and Affected Versions CNCF K3s versions 1.32.0-rc1 through 1.32.4-rc1+k3s1

Description A change in the Kubernetes kubelet configuration within the 1.32 branch transitioned from legacy CLI flags to the v1beta1.KubeletConfiguration structure. Due to the use of omitempty in the Go structure, a value of 0 for the ReadOnlyPort variable was omitted during marshaling, causing the kubelet to apply its own default and enable port 10255. This allows unauthenticated access to the /pods endpoint, which can expose sensitive information such as pod specifications, environment variables, and launch arguments, potentially leading to the disclosure of credentials and tokens.

Recommendations Update CNCF K3s to version 1.32.4-rc1+k3s1 or later. As a temporary mitigation, restrict access to port 10255 to prevent unauthenticated access to the kubelet read-only port.