VulnerabilityPublished 14 Nov 2025

CVE-2025-13033: Red Hat Advanced Cluster Management for Kubernetes 2 · Interpretation Conflict

Affects Red Hat Advanced Cluster Management for Kubernetes 2Source CVE Database V5

Not known to be exploited · CVSS 7.5 High.

Data as of 26 Oct 2026, 15:59 UTC

CVSS 3.1 base score

7.5High

How severe the flaw is on the 0–10 CVSS scale.

EPSS: 0.5% chance of exploitation in 30 days – higher than 47% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: None
Availability: None

Bold values are the worst case: easiest to exploit or largest impact.

Attack Vector: Network: The vulnerable component is bound to the network stack and the set of possible attackers extends beyond the other options listed, up to and including the entire Internet. Such a vulnerability is often termed 'remotely exploitable' and can be thought of as an attack being exploitable at the protocol level one or more network hops away (e.g., across one or more routers).
Attack Complexity: Low: Specialized access conditions or extenuating circumstances do not exist. An attacker can expect repeatable success against the vulnerable component.
Privileges Required: None: The attacker is unauthorized prior to attack, and therefore does not require any access to settings or files to carry out an attack.
User Interaction: None: The vulnerable system can be exploited without any interaction from any user.
Scope: Unchanged: An exploited vulnerability can only affect resources managed by the same security authority. In this case, the vulnerable component and the impacted component are either the same, or both are managed by the same security authority.
Confidentiality: High: There is total loss of confidentiality, resulting in all resources within the impacted component being divulged to the attacker. Alternatively, access to only some restricted information is obtained, but the disclosed information presents a direct, serious impact.
Integrity: None: There is no loss of integrity within the impacted component.
Availability: None: There is no impact to availability within the impacted component.

Definitions: FIRST CVSS v3.1 specification.

Exploitation evidence

Disclosed: evidence found.
CVE published 14 Nov 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors

A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.

Disclosed: The CVE record is public on cve.org. Its publication is t = 0.
Detectable: A public nuclei template can find exposed instances, for defenders and attackers alike.
Weaponised: Public exploit code exists in Metasploit or Exploit-DB, or CISA SSVC or the CVSS exploit maturity reports a public proof of concept.
Exploited in the wild: CISA KEV lists it, CISA SSVC rates exploitation active, or a source reports attacks.
Observed by OffSeq Mirage: OffSeq Mirage honeypot sensors recorded attack traffic for this CVE, or found exposed hosts without attack traffic.

Moments are spaced evenly, not to scale; a dashed line marks a gap of six months or more. Deltas count from t = 0. Sources that give only a date (CISA KEV, Exploit-DB, or a time of exactly 00:00Z) read “same day” rather than hours. Metasploit modules carry the flaw’s disclosure date, not their release date, and nuclei templates carry no date, so both appear above but not on the timeline.

What to do

AI-suggested

Monitor Red Hat’s official channels for patches addressing CVE-2025-13033 and apply them immediately upon release.
Until patches are available, implement strict email validation rules in the cluster management system to detect and block recipient addresses containing embedded external addresses or suspicious formatting.
Audit and restrict outbound email flows from the cluster management environment to trusted internal domains only, using email gateway filtering and Data Loss Prevention (DLP) tools.
Enable detailed logging and alerting on email sending events to detect anomalous or unauthorized email redirections.
Conduct regular security reviews of email parsing components and cluster management configurations to identify potential misuse.
Educate administrators about this vulnerability and encourage vigilance for unusual email activity related to cluster notifications.
Consider isolating or segmenting the cluster management network to limit exposure of email services to external networks.

Description

CVE-2025-13033 is a high-severity vulnerability in Red Hat Advanced Cluster Management for Kubernetes 2 caused by improper handling of specially formatted recipient email addresses in its email parsing library. An attacker can craft a recipient address embedding an external address within quotes, causing the system to misdirect sensitive emails to the attacker instead of the intended internal recipient. This flaw enables data leakage of sensitive information without requiring authentication or user interaction. The vulnerability has a CVSS score of 7.5, reflecting its network exploitability and high confidentiality impact. No known exploits are currently reported in the wild. European organizations using this Red Hat product, especially those managing Kubernetes clusters with integrated email notifications, face risks of confidential data exposure. Mitigation involves applying vendor patches once available, auditing email handling configurations, and implementing strict email validation and monitoring for anomalous outbound emails. Countries with significant Red Hat and Kubernetes adoption, such as Germany, France, and the UK, are most likely affected. Defenders should prioritize patching and monitoring to prevent unauthorized data exfiltration via email misdirection.

Impact

For European organizations, the impact of CVE-2025-13033 can be severe due to the potential leakage of sensitive operational, security, or personal data via misdirected emails. Organizations relying on Red Hat Advanced Cluster Management for Kubernetes 2 to manage critical infrastructure or cloud-native applications may inadvertently expose confidential information to attackers. This could lead to data breaches, regulatory non-compliance (e.g., GDPR violations), reputational damage, and potential lateral attacks if sensitive credentials or configuration details are leaked. The vulnerability’s network accessibility and lack of authentication requirements increase the risk of exploitation by remote attackers. Given the widespread adoption of Kubernetes and Red Hat solutions in European enterprises, especially in sectors like finance, telecommunications, and government, the threat could disrupt secure cluster management and compromise data confidentiality at scale.

Summary

CVE-2025-13033 is a vulnerability identified in the email parsing library of Red Hat Advanced Cluster Management for Kubernetes 2. The root cause is improper handling of recipient email addresses that are specially formatted to include an external email address enclosed within quotes. This parsing flaw leads the application to misinterpret the intended recipient and instead send emails to an attacker-controlled external address. Because the vulnerability allows an attacker to intercept sensitive emails, it poses a significant confidentiality risk. The flaw does not require any authentication or user interaction, making it remotely exploitable over the network. The vulnerability has been assigned a CVSS v3.1 score of 7.5, indicating high severity primarily due to its impact on confidentiality and ease of exploitation. Although no exploits have been reported in the wild yet, the potential for data leakage is considerable, especially in environments where sensitive operational or security information is communicated via email notifications from the cluster management system. The vulnerability affects Red Hat Advanced Cluster Management for Kubernetes 2, a product widely used to manage Kubernetes clusters at scale, often in enterprise and cloud environments. The lack of available patches at the time of reporting necessitates immediate attention to configuration and monitoring controls to mitigate risk until a fix is released.

References

Community reviews

Loading reviews…

Exploitation evidence

What to do

Description

AI analysisMachine-generated, updated 21 Nov 2025, 20:04 UTC

Technical details

References

Community reviews

Related threats