https://seclists.org/oss-sec/2025/q2/267: [kubernetes] CVE-2025-4563: Nodes can bypass dynamic source allocation authorization checks
Published Jun 19, 2025
·Updated
Affected Software
1 affected component
Kubernetes kube-apiserver>=1.32.0<=1.32.5, >=1.33.0<1.33.1
Frequently Asked Questions
1
What is the severity of CVE-2025-4563?
CVE-2025-4563 is rated as high severity due to its potential to allow unauthorized resource allocation by nodes.
2
How do I fix CVE-2025-4563?
To fix CVE-2025-4563, disable the DynamicResourceAllocation feature gate until a patch is applied.
3
What systems are affected by CVE-2025-4563?
CVE-2025-4563 affects Kubernetes deployments that have the NodeRestriction admission controller and have the DynamicResourceAllocation feature gate enabled.
4
When was CVE-2025-4563 published?
CVE-2025-4563 was published on June 19, 2025.
5
What kind of attack does CVE-2025-4563 facilitate?
CVE-2025-4563 facilitates unauthorized resource allocation by allowing nodes to bypass necessary authorization checks.