github.com
https://github.com/kubernetes/kubernetes CVE-2025-4563
LOW
Nodes can bypass dynamic resource allocation authorization checks
Record summary
CVE-2025-4563 has a selected CVSS score of 2.7 (low).
Description
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
Description source: CVE List
Exploitation context
CISA SSVC decision
ExploitationNone
AutomatableNo
Technical impactPartial
CISA Coordinator · SSVC 2.0.3 · Evaluated Jun 23, 2025 · Source: CVE List
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
KubernetesBrowse Kubernetes / KubernetesDefault status: unaffected | CVE List | v1.32.0 - v1.32.5 | affected |
| v1.33.0 - v1.33.1 | affected | ||
k8s.io/kubernetesBrowse Go / k8s.io/kubernetes | GitHub Advisory | 1.32.0 to < 1.32.6 · Fixed in 1.32.6 | affected |
| 1.33.0 to < 1.33.2 · Fixed in 1.33.2 | affected |
References
8github.comissue tracking
https://github.com/kubernetes/kubernetes/issues/132151 github.com
https://github.com/kubernetes/kubernetes/pull/131844 github.com
https://github.com/kubernetes/kubernetes/pull/131875 github.com
https://github.com/kubernetes/kubernetes/pull/131876 groups.google.commailing list
https://groups.google.com/g/kubernetes-security-announce/c/Zv84LMRuvMQ nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2025-4563 pkg.go.dev
https://pkg.go.dev/vuln/GO-2025-3774