F5 BIG-IP Next CVE-2025-55670
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain low-privilege API credentials
-
DeliverySend repeated undisclosed API calls
-
ExploitExhaust TMM resources (CWE-770)
-
ExecutionCrash Traffic Management Microkernel
-
ImpactData-plane denial of service
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V2 - Validation and Business Logic Resource allocation limits
MITRE ATT&CK
1 technique across 1 tactic: Impact The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires network reach to the management/API surface of BIG-IP Next CNF, BIG-IP Next SPK, or BIG-IP Next for Kubernetes AND at least low-privilege authenticated API access (CVSS PR:L) - it is not anonymous/unauthenticated. The attack consists of repeatedly invoking an undisclosed API endpoint until the Traffic Management Microkernel (TMM) terminates; no user interaction is needed (UI:N). Limiting factors: valid API credentials/authorization are required, impact is confined to availability (service crash/DoS - no data read or modification), and End-of-Technical-Support software versions are out of scope per the vendor note, so only supported releases are confirmed in-scope. |
| Impact | This is a moderate, availability-only risk rather than a top-tier emergency. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack that nonetheless requires at least low-level privileges (PR:L), i.e. an authenticated API caller, and its entire impact is availability (VA:H; VC:N/VI:N) - consistent with CWE-770 (uncontrolled resource consumption) causing the Traffic Management Microkernel (TMM) to terminate. All exploitation signals point low: EPSS is 0.31% (22nd percentile), the CVE is NOT on CISA KEV, and no public exploit code was provided - so exploitation status is 'no public exploit identified at time of analysis.' No SSVC decision record was supplied. The signals are internally consistent (modest EPSS matches the authenticated, DoS-only profile), so there is no CVSS-vs-real-risk conflict to flag; the main caveat is that the description is deliberately vague ('repeated undisclosed API calls'), so the exact trigger is not independently verifiable. Net: a legitimate patch-management item for F5 Next CNF/SPK/Kubernetes operators, but not a drop-everything issue given authentication is required, impact is DoS-only, and there is no evidence of active exploitation. |
| Exploit ScenarioDerived | An attacker who already holds valid low-privilege API credentials (or has compromised a client with API access) issues a stream of repeated undisclosed API calls against a BIG-IP Next CNF/SPK/for-Kubernetes instance. The uncontrolled resource consumption (CWE-770) drives the Traffic Management Microkernel (TMM) to terminate, dropping data-plane traffic and causing a denial of service. No public proof-of-concept was provided in the available data. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 18, 2026
Repeated calls to an undisclosed API endpoint can force the Traffic Management Microkernel (TMM) to terminate on F5 BIG-IP Next Cloud-Native Network Functions, BIG-IP Next Service Proxy for Kubernetes, and BIG-IP Next for Kubernetes, letting an attacker disrupt traffic processing on affected clusters. Exploitation requires network reach to the management/API surface plus valid low-privilege API credentials (CVSS PR:L), and impact is confined to availability with no confidentiality or integrity effect. EPSS is low at roughly 0.31% (22nd percentile), and no public exploit code or CISA KEV entry was identified at time of analysis; releases that have reached End of Technical Support are out of scope per the vendor.
RemediationAI
F5 tracks this issue under advisory K000154614 (https://my.f5.com/manage/s/article/K000154614); the provided data does not include an exact fixed version, so confirm the corrected release for each of BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes against that advisory and upgrade off affected builds, particularly since End-of-Technical-Support versions will not receive fixes. Until patched, reduce exposure by restricting network reachability to the management/API surface using Kubernetes NetworkPolicies or ingress rules limited to trusted admin CIDRs and namespaces, and tighten RBAC so only necessary service accounts hold API credentials - recognizing that overly broad restrictions can break automation and control-plane integrations. Place API rate limiting or a throttling reverse proxy in front of the management endpoint to blunt the repeated-call pattern, accepting added latency and possible throttling of legitimate burst operations, and monitor TMM restarts and pod CrashLoopBackOff events on affected clusters as a detection signal. Because exploitation requires valid low-privilege credentials, auditing and rotating API tokens for these deployments shrinks the pool of potential attackers.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause class is CWE-770, Allocation of Resources Without Limits or Throttling. BIG-IP Next Cloud-Native Network Functions, BIG-IP Next Service Proxy for Kubernetes, and BIG-IP Next for Kubernetes deliver F5's data-plane stack - including the Traffic Management Microkernel (TMM), the process responsible for packet forwarding, load balancing, and L4-L7 traffic handling - as containers orchestrated by Kubernetes and driven through an API-based control plane. Because that management API does not adequately bound or throttle repeated invocations of an undisclosed endpoint, sustained request traffic causes TMM to terminate, interrupting traffic handling on the affected pod until it restarts. CPE data confirms coverage across the CNF and SPK product lines plus BIG-IP Next for Kubernetes 2.0.0. The assessed vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H - network reachable and low complexity, but gated behind authenticated low-privilege API access, with availability as the only impacted pillar.
Know when Kubernetes gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Network-reachable API, low complexity, but requires authenticated low-privilege API access (PR:L); impact is availability-only (TMM crash), so C:N/I:N/A:H and scope unchanged.
Primary rating from Vendor (f5).
CVSS VectorVendor: f5
DescriptionCVE.org
On BIG-IP Next CNF, BIG-IP Next SPK, and BIG-IP Next for Kubernetes systems, repeated undisclosed API calls can cause the Traffic Management Microkernel (TMM) to terminate. Note: Software versions which have reached End of Technical Support (EoTS) are not evaluated.
Executive ViewAI
F5 BIG-IP Next Cloud-Native Network Functions, BIG-IP Next Service Proxy for Kubernetes, and BIG-IP Next for Kubernetes can experience Traffic Management Microkernel termination when an authenticated low-privilege API user repeatedly calls a specific endpoint, disrupting traffic processing on affected clusters. Leadership should care because this is an availability risk for Kubernetes-hosted traffic services, though exploitation requires network reach to the management/API surface and valid low-privilege credentials. No public exploit was identified at time of analysis, and no vendor-released patch is available.
No vendor-released patch identified at time of analysis; restrict management/API access to trusted networks, enforce least privilege and rotate low-privilege API credentials, rate-limit and monitor repeated API calls, and isolate affected clusters to limit traffic-processing disruption.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Denial of Service attacks render applications or systems unavailable by overwhelming resources or triggering failure conditions.
Affected Products (CPE)CVE.org
More in Kubernetes
View allA critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access
Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio
Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres
A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter
A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate
Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne
Unauthenticated remote attackers can trigger complete database overwrites, server-side file reads, and SSRF attacks agai
The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4
Fluentd configuration injection in the kube-logging Logging operator before 6.6.0 allows a namespace-scoped user who can
Authenticated Typebot users can abuse the webhook block (HTTP Request component) in versions prior to 3.13.1 to issue ar
GitHub PoC
Exploit-DB