Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact None

Vulnerable System Integrity Impact High

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact Low

Integrity Impact High

Availability Impact Low

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Vendors Products
Confidential-containers
  • Trustee

No data.

No data.

References
Link Providers
https://github.com/confidential-containers/trustee/commit/3a7d04a70918fa503a00974dcae653cf9f0640e0 cve-icon cve-icon cve-icon
https://github.com/confidential-containers/trustee/pull/957 cve-icon cve-icon cve-icon
https://github.com/confidential-containers/trustee/security/advisories/GHSA-49mc-2q77-m99x cve-icon cve-icon cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2025-61779 cve-icon
https://www.cve.org/CVERecord?id=CVE-2025-61779 cve-icon
History

Sat, 11 Oct 2025 00:15:00 +0000

Type Values Removed Values Added
References
Metrics threat_severity

None

 cvssV3_1

{'score': 8.6, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:L'}

threat_severity

Important

Fri, 10 Oct 2025 15:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}

Fri, 10 Oct 2025 11:30:00 +0000

Type Values Removed Values Added
First Time appeared Confidential-containers
Confidential-containers trustee
Vendors & Products Confidential-containers
Confidential-containers trustee

Thu, 09 Oct 2025 21:00:00 +0000

Type Values Removed Values Added
Description Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.
Title Trustee's attestation-policy endpoint is not protected by admin autentication
Weaknesses CWE-639
References
Metrics cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N'}
cve-icon MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2025-10-09T20:53:33.855Z

Updated: 2025-10-10T14:32:49.097Z

Reserved: 2025-09-30T19:43:49.901Z

Link: CVE-2025-61779

cve-icon Vulnrichment

Updated: 2025-10-10T14:32:38.952Z

cve-icon NVD

Status : Received

Published: 2025-10-09T21:15:39.960

Modified: 2025-10-10T15:16:06.530

Link: CVE-2025-61779

cve-icon Redhat

Severity : Important

Publid Date: 2025-10-09T20:53:33Z

Links: CVE-2025-61779 - Bugzilla