What is the CVSS score of CVE-2026-25804?

CVE-2026-25804 has a CVSS 3.1 base score of 9.1 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of Kubernetes are affected by CVE-2026-25804?

A critical vulnerability (CVSS 9.1) in Antrea Kubernetes networking could allow attackers to compromise cluster networking, potentially enabling unauthorized access to containerized applications and…. A patch is available.

How to fix or mitigate CVE-2026-25804?

Within 24 hours: Identify all Kubernetes clusters running Antrea and their current versions. Within 7 days: Apply the available vendor patch to all affected Antrea deployments, prioritizing production environments and those handling sensitive workloads. Within 30 days: Verify patch deployment across all clusters, confirm vulnerability remediation through security scanning, and document the remediation timeline.

Kubernetes CVE-2026-25804

CRITICAL

Improper Authentication (CWE-287)

2026-02-06 security-advisories@github.com

GHSA-86x4-wp9f-wrr9

Kubernetes Antrea Suse

9.1

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

9.1 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

SUSE

CRITICAL

qualitative

Primary rating from GitHub Advisory.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

High

Lifecycle Timeline

Analysis Generated

Mar 12, 2026 - 21:54 vuln.today

Patch released

Feb 28, 2026 - 00:30 nvd

Patch available

CVE Published

Feb 06, 2026 - 23:15 nvd

CRITICAL 9.1

DescriptionGitHub Advisory

Antrea is a Kubernetes networking solution intended to be Kubernetes native. Prior to versions 2.3.2 and 2.4.3, Antrea's network policy priority assignment system has a uint16 arithmetic overflow bug that causes incorrect OpenFlow priority calculations when handling a large numbers of policies with various priority values. This results in potentially incorrect traffic enforcement. This issue has been patched in versions 2.4.3.

AnalysisAI

Antrea Kubernetes networking has an authentication bypass enabling unauthorized access to the Kubernetes network policy infrastructure.

Technical ContextAI

Antrea < 2.3.2 has a CWE-287 improper authentication that allows unauthorized access to the Kubernetes networking solution's management interface.

RemediationAI

Update Antrea. Review network policies for unauthorized modifications.

More in Kubernetes

View all

CVE-2025-1974 CRITICAL Act Now POC

9.8 Mar 25

A critical vulnerability in Kubernetes ingress-nginx controller allows unauthenticated attackers with pod network access

CVE-2026-45321 CRITICAL Act Now POC

9.6 May 12

Credential-harvesting malware compromised 84 versions of 42 TanStack npm packages on 2026-05-11 via chained GitHub Actio

CVE-2025-1098 HIGH Act Now POC

8.8 Mar 25

Kubernetes ingress-nginx contains a configuration injection vulnerability via the mirror-target and mirror-host Ingress

CVE-2025-24514 HIGH Act Now POC

8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-url` Ingres

CVE-2025-1097 HIGH Act Now POC

8.8 Mar 25

A security issue was discovered in ingress-nginx https://github.com/kubernetes/ingress-nginx where the `auth-tls-match-c

CVE-2020-8554 MEDIUM This Month POC

6.3 Jan 21

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.exter

CVE-2025-55190 CRITICAL Act Now POC

9.9 Sep 04

Argo CD is a declarative, GitOps continuous delivery tool for Kubernetes. Rated critical severity (CVSS 9.9), this vulne

CVE-2018-18843 CRITICAL Act Now POC

10.0 Dec 04

The Kubernetes integration in GitLab Enterprise Edition 11.x before 11.2.8, 11.3.x before 11.3.9, and 11.4.x before 11.4

CVE-2026-22039 CRITICAL Act Now POC

9.9 Jan 27

Kyverno Kubernetes policy engine prior to 1.x has a privilege escalation vulnerability (CVSS 9.9) allowing policy bypass

CVE-2024-42480 CRITICAL Act Now POC

9.9 Aug 12

Kamaji is the Hosted Control Plane Manager for Kubernetes. Rated critical severity (CVSS 9.9), this vulnerability is rem

CVE-2023-28110 CRITICAL Act Now POC

9.9 Mar 16

Jumpserver is a popular open source bastion host, and Koko is a Jumpserver component that is the Go version of coco, ref

CVE-2026-25996 CRITICAL Act Now POC

9.8 Feb 12

String filter bypass in Inspektor Gadget Kubernetes eBPF tooling before fix. Insufficient string escaping enables filter

Same weakness CWE-287 – Improper Authentication

View all

CVE-2020-0688 HIGH POC

8.8

CVE-2023-46805 HIGH POC

8.2

CVE-2015-1187 CRITICAL POC

9.8

CVE-2024-7593 CRITICAL POC

9.8

CVE-2017-7921 CRITICAL POC

9.8

CVE-2024-53704 CRITICAL POC

9.8

CVE-2015-7755 CRITICAL POC

9.8

CVE-2013-0625 CRITICAL POC

9.8

Vendor StatusVendor

SUSE

Severity: Critical

Product	Status
openSUSE Leap 15.6	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP5	Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP6	Fixed
openSUSE Leap 15.5	Fixed

CVE-2026-25804 vulnerability details – vuln.today

Back

Kubernetes CVE-2026-25804

Severity by source

CVSS VectorGitHub Advisory

Lifecycle Timeline

DescriptionGitHub Advisory

AnalysisAI

Technical ContextAI

RemediationAI

More in Kubernetes

Same weakness CWE-287 – Improper Authentication

Vendor StatusVendor

SUSE

Share

External POC / Exploit Code