4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-48710

CVE-2025-48710: kro Confused Deputy vulnerability

kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-48710

CVE-2025-48710:

4.1

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
github.com/kro-run/kro	go	>= 0.1.0, < 0.2.1	0.2.1

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability CVE-2025-48710 in kro allows users with specific permissions to supply arbitrary container images in ResourceGraphDefinition resources, leading to potential remote code execution. This is a 'confused deputy' vulnerability. The patch in version 0.2.1, specifically commit f582124880747b590d775b09aee742c09887f213, addresses this by improving the schema parsing logic in pkg/graph/parser/parser.go. The core issue was the mishandling of the x-kubernetes-preserve-unknown-fields schema extension. When this extension is present, fields that should have been validated (like container image paths) might have been accepted without proper checks. The modified functions (getExpectedTypes, validateSchema, parseObject) now correctly account for this extension, ensuring that even with x-kubernetes-preserve-unknown-fields, the necessary validations occur or the fields are treated appropriately. The ParseResource function, as the orchestrator of the parsing process, is indirectly implicated as it relies on these corrected sub-functions. An attacker could exploit this by crafting a ResourceGraphDefinition that uses this schema extension to sneak in a malicious container image reference, which kro would then deploy.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.