Nodes can bypass dynamic resource allocation authorization checks
Key facts
- Attack vector
- Network
- Privileges required
- High
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · None · Low
- Fix status
- Partial Red Hat: 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.
Summary
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
Why it matters now
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | v1.32.0 - v1.32.5; v1.33.0 - v1.33.1 | — | No fix listed | CNA |
| — | k8s.io/kubernetes (Go) | 1.32.0 to before 1.32.6 | 1.32.6 | Patch available | GHSA-hj2p-8wj8-pfq4 |
| — | k8s.io/kubernetes (Go) | 1.33.0 to before 1.33.2 | 1.33.2 | Patch available | GHSA-hj2p-8wj8-pfq4 |
- Kubernetes VendorKubernetes Affected v1.32.0 - v1.32.5; v1.33.0 - v1.33.1 Fixed in — No fix listed CNA
- k8s.io/kubernetes (Go) Vendor— Affected 1.32.0 to before 1.32.6 Fixed in 1.32.6 Patch available GHSA-hj2p-8wj8-pfq4
- k8s.io/kubernetes (Go) Vendor— Affected 1.33.0 to before 1.33.2 Fixed in 1.33.2 Patch available GHSA-hj2p-8wj8-pfq4
CPE names Threatist (inferred) · 1
Inferred from how NVD named this product before; not given by a source.
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | — | — | Kubernetes |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions — — ·Kubernetes
Remediation
- Fix · GHSA-hj2p-8wj8-pfq4 k8s.io/kubernetes (Go) Fixed in 1.32.6 Advisory →
- Fix · GHSA-hj2p-8wj8-pfq4 k8s.io/kubernetes (Go) Fixed in 1.33.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 4 | Affected | No fix yet: Fix deferred |
Not affected: 1 product
- Red Hat OpenShift Container Platform 4
Timeline
- 2026-10-02 Threatist record created from CVE-2025-4563
- 2026-10-03 Alias added: GHSA-hj2p-8wj8-pfq4
References
Other 7
- https://groups.google.com/g/kubernetes-security-announce/c/Zv84LMRuvMQ
- https://github.com/kubernetes/kubernetes/issues/132151
- https://github.com/kubernetes/kubernetes/pull/131844
- https://github.com/kubernetes/kubernetes/pull/131875
- https://github.com/kubernetes/kubernetes/pull/131876
- https://github.com/kubernetes/kubernetes
- https://pkg.go.dev/vuln/GO-2025-3774
More Kubernetes vulnerabilities
- TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
- TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8
Sources
- CVE-2025-4563 · CVE Program
- CVE-2025-4563 · NVD
- FIRST EPSS
- GHSA-hj2p-8wj8-pfq4 · GitHub Advisory Database · CC BY 4.0
- CVE-2025-4563 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences