CVE-2025-64434

CVE-2025-64434 is a medium-severity vulnerability affecting KubeVirt versions prior to 1.5.3 and 1.6.1, a virtual machine management add-on for Kubernetes. An attacker who compromises a virt-handler instance can exploit shared credentials to impersonate virt-api, enabling privileged operations against other virt-handler instances. This could compromise the integrity and availability of managed VMs. The attack requires local access and high attack complexity, but can lead to high impact on integrity and availability. There is currently no evidence of active exploitation, public exploit code, or significant community discussion beyond a single security update notice.