CVE-2025-1146
Raw vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:HCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2025-1146 is a high-severity Improper Following of a Certificate's Chain of Trust (CWE-296) vulnerability. Its CVSS base score is 8.1 (High).
Operationally, exploitation aligns with the MITRE ATT&CK technique Subvert Trust Controls (T1553); ranked at the 17th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.
The strongest mitigations our analysis identified map to SC-17 (Public Key Infrastructure Certificates) — see the control section below for these in your framework.
Deeper analysis AI-assisted summary
Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.
CVE-2025-1146 is a validation logic error in the TLS connection routine of CrowdStrike's Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor. This flaw causes incorrect processing of server certificate validation during secure communications from these components to the CrowdStrike cloud. Windows and Mac sensors are not affected. The vulnerability is rated at CVSS 3.1 score of 8.1 (AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H) and maps to CWE-296.
An attacker with the ability to control network traffic between the affected sensors and the CrowdStrike cloud could exploit this issue to conduct a man-in-the-middle (MiTM) attack. Successful exploitation would allow compromise of confidentiality, integrity, and availability of those TLS-secured communications.
CrowdStrike's security advisory details that the company identified and fixed this issue internally through its security review process, releasing the patch in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above. Additional information is available at https://www.crowdstrike.com/security-advisories/cve-2025-1146/.
CrowdStrike reports no indications of exploitation in the wild and is actively monitoring for potential abuse using its threat hunting and intelligence capabilities.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2025-2021
Vulnerability Data
CrowdStrike uses industry-standard TLS (transport layer security) to secure communications from the Falcon sensor to the CrowdStrike cloud. CrowdStrike has identified a validation logic error in the Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor where…
more
our TLS connection routine to the CrowdStrike cloud can incorrectly process server certificate validation. This could allow an attacker with the ability to control network traffic to potentially conduct a man-in-the-middle (MiTM) attack. CrowdStrike identified this issue internally and released a security fix in all Falcon sensor for Linux, Falcon Kubernetes Admission Controller, and Falcon Container Sensor versions 7.06 and above. CrowdStrike identified this issue through our longstanding, rigorous security review process, which has been continually strengthened with deeper source code analysis and ongoing program enhancements as part of our commitment to security resilience. CrowdStrike has no indication of any exploitation of this issue in the wild. CrowdStrike has leveraged its world class threat hunting and intelligence capabilities to actively monitor for signs of abuse or usage of this flaw and will continue to do so. Windows and Mac sensors are not affected by this.
- CWE(s)
Related Threats
MITRE ATT&CK Enterprise Techniques
CVEs Like This One
Affected Assets
Mitigating Controls
Control response
—
—
- 12 hardening rules · 5 OS baselines
—
Mitigating Controls (NIST 800-53 r5) AI
SC-17 requires proper issuance and management of PKI certificates, which structurally enforces correct chain-of-trust validation.
Mitigating Controls (NIST CSF 2.0) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.
Proper service/hardware authentication requires correct certificate chain validation to a trusted root.
Pre-acquisition authenticity checks may surface certificate issues but do not address runtime chain-following logic.
Verifying identity assertions includes ensuring certificate chains are followed correctly.
Protecting data-in-transit commonly depends on TLS certificate chain validation.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
Mandates proper use of cryptography including certificate validation and trusted roots.
Security testing can detect missing or incorrect certificate chain validation.
Secure coding standards address correct certificate chain validation.
Requires secure authentication mechanisms that rely on valid certificate chains.
Network security controls often enforce TLS certificate validation.
Secure network services depend on correct certificate chain validation.
Hardening callouts derived
Configuration rules from DISA STIG baselines that bear on weaknesses of the type cited by this CVE. Each rule is shown with the relationship its mapping actually records, against the CWE it was authored against. Derived via CVE→CWE over `controls_xwalks` (authoritative rows only; rows rated `none` are excluded).
Oracle Linux 8 (1 rule)
- V-248531 OL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-296
Oracle Linux 9 (1 rule)
- V-271604 OL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-296
RHEL 8 (1 rule)
- V-230229 RHEL 8, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-296
RHEL 9 (1 rule)
- V-258131 RHEL 9, for PKI-based authentication, must validate certificates by constructing a certification path (which includes status information) to an accepted trust anchor. prevents CWE-296