id: GO-2025-3646
modules:
    - module: github.com/k3s-io/k3s
      non_go_versions:
        - introduced: 1.32.0-rc1
        - fixed: 1.32.4-rc1
      vulnerable_at: 1.0.1
summary: CNCF K3s Kubernetes kubelet configuration exposes credentials in github.com/k3s-io/k3s
cves:
    - CVE-2025-46599
ghsas:
    - GHSA-864f-7xjm-2jp2
references:
    - advisory: https://github.com/advisories/GHSA-864f-7xjm-2jp2
    - advisory: https://nvd.nist.gov/vuln/detail/CVE-2025-46599
    - fix: https://github.com/k3s-io/k3s/commit/097b63e588e3c844cdf9b967bcd0a69f4fc0aa0a
    - report: https://github.com/k3s-io/k3s/issues/12164
    - web: https://cloud.google.com/kubernetes-engine/docs/how-to/disable-kubelet-readonly-port
    - web: https://github.com/f1veT/BUG/issues/2
    - web: https://github.com/k3s-io/k3s/compare/v1.32.3+k3s1...v1.32.4-rc1+k3s1
source:
    id: GHSA-864f-7xjm-2jp2
    created: 2025-04-29T12:46:32.786602-04:00
review_status: UNREVIEWED