2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-4563

CVE-2025-4563: kubernetes allows nodes to bypass dynamic resource allocation authorization checks

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-4563

CVE-2025-4563:

2.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
k8s.io/kubernetes	go	>= 1.32.0, <= 1.32.5	1.32.6
k8s.io/kubernetes	go	>= 1.33.0, <= 1.33.1	1.33.2

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability stems from a missing authorization check in the NodeRestriction admission controller, which failed to validate ResourceClaims during pod creation by a node. This allowed a compromised node to create a mirror pod that could access unauthorized dynamic resources. The analysis of the patch reveals a defense-in-depth approach to mitigation, with fixes applied at three distinct stages of pod processing.

Admission Control (admitPodCreate): The primary vulnerability is addressed in the admitPodCreate function of the NodeRestriction admission plugin. This is the point where the authorization decision should have been made. The patch adds the crucial missing check to forbid a node from creating pods that reference ResourceClaims.
API Validation (validatePodResourceClaim): As a second layer of security, the generic API validation logic is hardened. The validatePodResourceClaim function now explicitly blocks static pods (mirror pods) from being created with ResourceClaims, preventing such invalid objects from entering the system.
Kubelet Configuration (tryDecodeSinglePod): The third layer of defense is at the kubelet level. When the kubelet reads a static pod manifest from a file, the tryDecodeSinglePod function now rejects it if it contains ResourceClaims. This ensures that even if a malicious manifest is placed on the node's filesystem, the kubelet will refuse to process it.

An attacker exploiting this vulnerability would trigger a code path involving these three functions. The absence of checks in these functions in their vulnerable state would allow the malicious pod to be created. Therefore, these functions are key runtime indicators for detecting exploitation attempts.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.