CVE-2025-48710

MediumCVSS 4.1/10Last modified Jun 17, 2026

Description

kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.

Metrics

CVSS 3.1 4.1/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N

Weakness enumeration

CWE-441

Affected software

No affected versions have been published.

Timeline

Published
Jun 4, 2025
Last modified
Jun 17, 2026
NVD status
Deferred

Related CVEs from 2025

CVE-2025-48729.8A vulnerability, which was classified as critical, was found in FreeFloat FTP Server 1.0. Affected is an unknown function of the component CCVE-2025-487216.5A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administraCVE-2025-487226.5A NULL pointer dereference vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can thenCVE-2025-487238.1A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit CVE-2025-487248.1A buffer overflow vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit CVE-2025-487258.1A buffer overflow vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains a user accounCVE-2025-487264.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-487274.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-487284.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-487294.9A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2025-48739.8A vulnerability has been found in PHPGurukul News Portal 4.1 and classified as critical. Affected by this vulnerability is an unknown functiCVE-2025-487306.5A use of externally-controlled format string vulnerability has been reported to affect several QNAP operating system versions. If a remote a
CVE-2025-48710: Medium severity, CVSS 4.1 | Vulnix