CVE-2025-61779None▾ Sunlit

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them

▾ Sunlit zone — Low / medium · no exploitation signal

Depth score3/ 100 · Minimal

impact 2.8 · likelihood 0.1 · exploitation 0

⚡ Agent-ready:Raw markdown ↗JSON ↗

Proof of concept

Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.

…

Published

Oct 9, 2025

Updated

Oct 8, 2026

CVSS

—

Vendor

—

Product

—

CWE

CWE-639

Depth score

3 · Minimal

EPSS

0.45% · p39

Platforms

—

Source

NVD

Vector

—

EPSS history

Exploit-prediction probability, daily snapshots since Oct 8.

0.4% → 0.4%▲ 0.09%

Timeline

Disclosure to exploitation, from the record and what we observed since indexing it.

4 events · 366 days

Oct 9, 2025Published
Disclosed via NVD
Oct 8, 2026Record revised
Last analysed / modified upstream
Oct 8, 2026EPSS first tracked
0.4%
Oct 10, 2026EPSS peak
0.4% → 0.4%

CWE-639 #nvd

Full technical detail▾

Overview

Confidential Containers's Trustee project contains tools and components for attesting confidential guests and providing secrets to them. In versions prior to 0.15.0, the attestation-policy endpoint didn't check if the kbs-client submitting the request was actually authenticated (had the right key). This allowed any kbs-client to actually change the attestation policy. Version 0.15.0 fixes the issue.

Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

References

Related vulnerabilities

Connected by shared product, vendor, weakness, or advisory.

#nvd

← Back to feed