kro (Kube Resource Orchestrator) 0.1.0 before 0.2.1 allows users (with permission to create or modify ResourceGraphDefinition resources) to supply arbitrary container images. This can lead to a confused-deputy scenario where kro's controllers deploy and run attacker-controlled images, resulting in unauthenticated remote code execution on cluster nodes.
{ "nvd_published_at": "2025-06-04T06:15:21Z", "severity": "MODERATE", "github_reviewed_at": "2025-06-05T05:10:13Z", "github_reviewed": true, "cwe_ids": [ "CWE-441" ] }