CVE-2025-4563

Description

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.

PUBLISHED Reserved 2025-05-12 | Published 2025-06-23 | Updated 2025-06-23 | Assigner kubernetes

Problem types

CWE-20 Improper Input Validation

Product status

Credits

amitschendel reporter

References

groups.google.com/...ernetes-security-announce/c/Zv84LMRuvMQ mailing-list

github.com/kubernetes/kubernetes/issues/132151 issue-tracking

cve.org (CVE-2025-4563)

nvd.nist.gov (CVE-2025-4563)

Download JSON

Data based on CVE®. Copyright © 1999-2025, The MITRE Corporation. All rights reserved.