GHSA-pv22-fqcj-7xwh
Inspektor Gadget Security Policies Can be Bypassed
GHSA-pv22-fqcj-7xwh is a medium vulnerability (CVSS 6.7) in github.com/inspektor-gadget/inspektor-gadget, published May 6, 2025. No source lists public exploit code. Fixed in github.com/inspektor-gadget/inspektor-gadget 0.40.0.
- Severity
- 6.7 MediumCVSS 3.1, GitHub Advisories
- Exploit chance
- UnscoredNo EPSS score yet
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
0.40.0github.com/inspektor-gadget/inspektor-gadget
Description
Security policies like allowed-gadgets, disallow-pulling, verify-image can be bypassed by a malicious client.
Impact
Users running ig in daemon mode or IG on Kubernetes that rely on any of the features mentioned above are vulnerable to this issue. In order to exploit this, the client needs access to the server, like the correct TLS certificates on the ig daemon case or access to the cluster in the Kubernetes case.
Patches
The issue has been fixed in v0.40.0
Workarounds
There is not known workaround to fix it.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- High
Affected packages
| Package | Affected | Fixed |
|---|---|---|
github.com/inspektor-gadget/inspektor-gadgetGo | 0.31.0 up to 0.40.0 | 0.40.0 |
What each source reports
GitHub Advisories Score used
Inspektor Gadget Security Policies Can be Bypassed
Security policies like allowed-gadgets, disallow-pulling, verify-image can be bypassed by a malicious client.
Impact
Users running ig in daemon mode or IG on Kubernetes that rely on any of the features mentioned above are vulnerable to this issue. In order to exploit this, the client needs access to the server, like the correct TLS certificates on the ig daemon case or access to the cluster in the Kubernetes case.
Patches
The issue has been fixed in v0.40.0
Workarounds
There is not known workaround to fix it.
- Record
GHSA-pv22-fqcj-7xwh- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
OSV
Inspektor Gadget Security Policies Can be Bypassed
Security policies like allowed-gadgets, disallow-pulling, verify-image can be bypassed by a malicious client.
Impact
Users running ig in daemon mode or IG on Kubernetes that rely on any of the features mentioned above are vulnerable to this issue. In order to exploit this, the client needs access to the server, like the correct TLS certificates on the ig daemon case or access to the cluster in the Kubernetes case.
Patches
The issue has been fixed in v0.40.0
Workarounds
There is not known workaround to fix it.
- Record
GHSA-pv22-fqcj-7xwh- CVSS 3.1
- 6.7 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:H - Weakness
- CWE-285
- Updated
- 2026-11-02
OSVGO-2025-3665No score
Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget
Inspektor Gadget Security Policies Can be Bypassed in github.com/inspektor-gadget/inspektor-gadget
- Record
GO-2025-3665- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | GitHub Advisories, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.