kro Confused Deputy vulnerability
Date: 2025-06
Affected: go/github.com/kro-run/kro
Attack vector: rce
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2025-48710
CWE: CWE-441
CVSS: 4.1 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:L/A:N)

kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.


Mitigations:

Architectural layers (MAESTRO):