CVE-2025-9708

Published: Sep 16, 2025Modified: Jun 17, 2026Deferred

6.8

Vector

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:N

Exploitability: 1.6 / Impact: 5.2

Source: jordan@liggitt.net (Secondary)

Description

A vulnerability exists in the Kubernetes C# client where the certificate validation logic accepts properly constructed certificates from any Certificate Authority (CA) without properly verifying the trust chain. This flaw allows a malicious actor to present a forged certificate and potentially intercept or manipulate communication with the Kubernetes API server, leading to possible man-in-the-middle attacks and API impersonation.

Related CWEs

CWE-295

Improper Certificate Validation

The product does not validate, or incorrectly validates, a certificate.

References (3)

https://github.com/kubernetes/kubernetes/issues/134063

Source: jordan@liggitt.net

https://groups.google.com/g/kubernetes-security-announce/c/rLopt2Msvbw/m/rK6XeNw2CgAJ

Source: jordan@liggitt.net

http://www.openwall.com/lists/oss-security/2025/09/16/1

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.