CVE-2025-4563

Published Jun 23, 2025

Last updated 3 months ago

Kubernetes

Overview

AI description

Automated description summarized from trusted sources.

CVE-2025-4563 is an incorrect authorization vulnerability found in Kubernetes kube-apiserver. It stems from improper access control mechanisms within the NodeRestriction Admission Controller, which allows nodes to bypass dynamic resource allocation authorization checks. This vulnerability could be exploited by attackers with low-privileged network access to gain unauthorized access to sensitive information or partially modify system configurations. It is recommended to upgrade to version 1.32.6 or 1.33.2 to eliminate this vulnerability or, if not actively using DynamicResourceAllocation features, turn off the feature on the API server.

Description: A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
Source: jordan@liggitt.net
NVD status: Awaiting Analysis

Risk scores

CVSS 3.1

Type: Secondary
Base score: 2.7
Impact score: 1.4
Exploitability score: 1.2
Vector string: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L
Severity: LOW

Weaknesses

jordan@liggitt.net: CWE-20

Hype score: Not currently trending

References