CVE-2025-61779

HIGH

Confidential Containers Trustee <0.15.0 - Auth Bypass

Title source: llm
STIX 2.1

Description

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.

References (3)

Core 3

Scores

CVSS v4 8.7
EPSS 0.0006
EPSS Percentile 17.1%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

CISA SSVC

Vulnrichment
Exploitation poc
Automatable yes
Technical Impact partial

Details

CWE
CWE-639
Status published
Products (1)
confidential-containers/trustee < 0.15.0
Published Oct 09, 2025
Tracked Since Feb 18, 2026