CVE-2025-61779 HIGH

CVE-2025-61779: Trustee's attestation-policy endpoint is not protected by admin autentication

Vendor Confidential-Containers
Product trustee
Weakness CWE-639 · IDOR
Published October 9, 2025
Last update October 10, 2025
View on NVD All CVEs

CVSS base score

8.7/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.

Key dates

02Disclosure timeline

October 9, 2025 CVE published
October 10, 2025 Record updated