GitHub Advisoryadvisory · Go
GHSA-gf93-xccm-5g6j MARIN3R: Cross-Namespace Vulnerability in the Operator
HIGH
Official page ↗
- Aliases
- CVE-2025-64171
- Ecosystem
- Go
- Packages
- github.com/3scale-sre/marin3r
- Severity
- High
- CVSS vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N
- Weaknesses
- CWE-862
- Reviewed
- 2025-11-04
Affected packages
• Go github.com/3scale-sre/marin3r: < 0.13.4 → fixed in 0.13.4
Description
Summary
Cross-namespace Secret access vulnerability in DiscoveryServiceCertificate
allows users to bypass RBAC and access Secrets in unauthorized namespaces.
Affected Versions
All versions prior to v0.13.4
Patched Versions
v0.13.4 and later
Impact
Users with permission to create DiscoveryServiceCertificate resources in one
namespace can indirectly read Secrets from other namespaces, completely
bypassing Kubernetes RBAC security boundaries.
Workarounds
Restrict DiscoveryServiceCertificate create permissions to cluster administrators
only until patched version is deployed.
Credit
Thanks to @debuggerchen for the responsible disclosure.
Related
Alias · CVE (1)
- CVE-2025-64171 MARIN3R is a lightweight, CRD based envoy control plane for kubernetes. vulnerability
Weakness · CWE (1)
- CWE-862 Missing Authorization weakness
References
- https://github.com/3scale-sre/marin3r/security/advisories/GHSA-gf93-xccm-5g6j web
- https://nvd.nist.gov/vuln/detail/CVE-2025-64171 advisory
- https://github.com/3scale-sre/marin3r/pull/294 web
- https://github.com/3scale-sre/marin3r/commit/859b14115fde1d67620e645cd1b62e90e30d9981 web
- https://github.com/3scale-sre/marin3r/commit/c60246a43ae8c0c38dd7267f298d68a121a159fa web
- https://github.com/3scale-sre/marin3r package