{"cve":"CVE-2025-4563","nvd":{"published":"2025-06-23T16:15:27.350","modified":"2026-06-17T09:33:31.753","status":"Deferred","description":"A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L","score":2.7},"cwes":["CWE-20"],"references":["https://github.com/kubernetes/kubernetes/issues/132151","https://groups.google.com/g/kubernetes-security-announce/c/Zv84LMRuvMQ"],"products":[],"source":"nvd","synced_at":"2026-10-19T22:03:23.287444849+00:00"},"epss":{"cve":"CVE-2025-4563","score":0.00827,"percentile":0.57503,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hj2p-8wj8-pfq4","url":"https://osv.dev/vulnerability/GHSA-hj2p-8wj8-pfq4","summary":"kubernetes allows nodes to bypass dynamic resource allocation authorization checks","modified":"2026-09-10T03:50:25.286875551Z","packages":[{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.32.0 <1.32.6"],"fixed":["1.32.6"]},{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.33.0 <1.33.2"],"fixed":["1.33.2"]}]},{"id":"GO-2025-3774","url":"https://osv.dev/vulnerability/GO-2025-3774","summary":"Kubernetes allows nodes to bypass dynamic resource allocation authorization checks in k8s.io/kubernetes","modified":"2026-02-04T02:37:40.807397Z","packages":[{"ecosystem":"Go","name":"k8s.io/kubernetes","purl":"pkg:golang/k8s.io/kubernetes","ranges":[">=1.32.0 <1.32.6",">=1.33.0 <1.33.2"],"fixed":["1.32.6","1.33.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}