CVE-2025-4563: Nodes can bypass dynamic resource allocation authorization checks
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
Affected Software
Remediation
Information
Event History
Frequently Asked Questions
What is the severity of CVE-2025-4563?
CVE-2025-4563 has a high severity due to potential unauthorized access to dynamic resource allocation.
How do I fix CVE-2025-4563?
To fix CVE-2025-4563, ensure that the DynamicResourceAllocation feature gate is properly configured and validate node authorization rules.
Which versions of Kubernetes are affected by CVE-2025-4563?
CVE-2025-4563 affects certain versions of Kubernetes where the NodeRestriction admission controller is improperly configured.
What is the impact of CVE-2025-4563?
The impact of CVE-2025-4563 includes the risk of nodes bypassing resource allocation authorization checks, potentially leading to resource misuse.
Is there a workaround for CVE-2025-4563 until a patch is available?
A recommended workaround for CVE-2025-4563 is to disable the DynamicResourceAllocation feature gate until an official patch is applied.