Vulnerability · Published Jun 23, 2025 · Assigned by kubernetes
CVE-2025-4563Nodes can bypass dynamic resource allocation authorization checks
Low 2.7
In plain English
A low-severity improper input validation in Kubernetes from Kubernetes. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.8% (higher than 58% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2025-4563 |
| Debian:13 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2025-4563 |
| Debian:14 | kubernetes | 1.20.5+really1.20.2-1 | DEBIAN-CVE-2025-4563 |
| Go | k8s.io/kubernetes | 1.32.6 | GHSA-hj2p-8wj8-pfq4 |
| Go | k8s.io/kubernetes | 1.33.2 | GHSA-hj2p-8wj8-pfq4 |
| Go | k8s.io/kubernetes | 1.32.6, 1.33.2 | GO-2025-3774 |
| Ubuntu:22.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2025-4563 |
| Ubuntu:24.04:LTS | kubernetes | no fix listed | UBUNTU-CVE-2025-4563 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | v1.32.0 - v1.32.5v1.33.0 - v1.33.1 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L