CVE-2025-46599: k3s

Medium severity, CVSS 6.8. EPSS: 0.5% chance of exploitation in the next 30 days.

CNCF K3s 1.32 before 1.32.4-rc1+k3s1 has a Kubernetes kubelet configuration change with the unintended consequence that, in some situations, ReadOnlyPort is set to 10255. For example, the default behavior of a K3s online installation might allow unauthenticated access to this port, exposing credentials.

Affected products

• k3s k3s: from 1.32, before 1.32.4-rc1+k3s (fixed in 1.32.4-rc1+k3s)

Published 2025-04-25. Last modified 2026-06-17.