CVE-2025-4563
Fixed in a distro release EPSS <1%CVSS 2.7
A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | 1.32.6 |
| Go | k8s.io/kubernetes | 1.33.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-cd-3.0 | 3.0.6-r2 |
| Chainguard | argo-cd-3.0-compat | 3.0.6-r2 |
| Chainguard | argo-cd-3.0-iamguarded-compat | 3.0.6-r2 |
| Chainguard | argo-cd-3.0-repo-server | 3.0.6-r2 |
| Chainguard | argo-cd-3.1 | 3.1.0-r1 |
| Chainguard | argo-cd-3.1-compat | 3.1.0-r1 |
| Chainguard | argo-cd-3.1-iamguarded-compat | 3.1.0-r1 |
| Chainguard | argo-cd-3.1-repo-server | 3.1.0-r1 |
| Chainguard | argo-cd-fips-3.0 | 3.0.9-r1 |
| Chainguard | argo-cd-fips-3.0-compat | 3.0.9-r1 |
| Chainguard | argo-cd-fips-3.0-iamguarded-compat | 3.0.9-r1 |
| Chainguard | argo-cd-fips-3.0-repo-server | 3.0.9-r1 |
| Chainguard | argo-cd-fips-3.1 | 3.1.0-r1 |
| Chainguard | argo-cd-fips-3.1-compat | 3.1.0-r1 |
| Chainguard | argo-cd-fips-3.1-iamguarded-compat | 3.1.0-r1 |
| Chainguard | argo-cd-fips-3.1-repo-server | 3.1.0-r1 |
| Chainguard | azuredisk-csi-1.32 | 1.32.7-r2 |
| Chainguard | azuredisk-csi-1.32-compat | 1.32.7-r2 |
| Chainguard | azuredisk-csi-1.33 | 1.33.1-r2 |
| Chainguard | azuredisk-csi-1.33-compat | 1.33.1-r2 |
| Chainguard | azuredisk-csi-fips-1.32 | 1.32.7-r2 |
| Chainguard | azuredisk-csi-fips-1.33 | 1.33.1-r2 |
| Chainguard | azurefile-csi-1.33 | 1.33.2-r1 |
| Chainguard | azurefile-csi-1.33-compat | 1.33.2-r1 |
| Chainguard | azurefile-csi-fips-1.32 | 1.32.4-r2 |
| Chainguard | azurefile-csi-fips-1.32-compat | 1.32.4-r2 |
| Chainguard | azurefile-csi-fips-1.33 | 1.33.2-r1 |
| Chainguard | azurefile-csi-fips-1.33-compat | 1.33.2-r1 |
| Chainguard | blob-csi-1.26 | 1.26.5-r51 |
| Chainguard | blob-csi-1.26-compat | 1.26.5-r51 |
| Chainguard | blob-csi-fips-1.26 | 1.26.5-r51 |
| Chainguard | blob-csi-fips-1.26-compat | 1.26.5-r51 |
| Chainguard | calico-3.30 | 3.30.2-r1 |
| Chainguard | calico-apiserver-3.30 | 3.30.2-r1 |
| Chainguard | calico-apiserver-compat-3.30 | 3.30.2-r1 |
| Chainguard | calico-apiserver-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-app-policy-3.30 | 3.30.2-r1 |
| Chainguard | calico-app-policy-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-cni-3.30 | 3.30.2-r1 |
| Chainguard | calico-cni-compat-3.30 | 3.30.2-r1 |
| Chainguard | calico-cni-compat-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-cni-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-felix-3.30 | 3.30.2-r1 |
| Chainguard | calico-felix-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-goldmane-3.30 | 3.30.2-r1 |
| Chainguard | calico-goldmane-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-key-cert-provisioner-3.30 | 3.30.2-r1 |
| Chainguard | calico-key-cert-provisioner-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-kube-controllers-3.30 | 3.30.2-r1 |
| Chainguard | calico-kube-controllers-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-node-3.30 | 3.30.2-r1 |
| Chainguard | calico-node-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-pod2daemon-3.30 | 3.30.2-r1 |
| Chainguard | calico-pod2daemon-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-pod2daemon-flexvol-compat-3.30 | 3.30.2-r1 |
| Chainguard | calico-typha-client-3.30 | 3.30.2-r1 |
| Chainguard | calico-typha-client-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-typhad-3.30 | 3.30.2-r1 |
| Chainguard | calico-typhad-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-whisker-3.30 | 3.30.2-r1 |
| Chainguard | calico-whisker-backend-3.30 | 3.30.2-r1 |
| Chainguard | calico-whisker-backend-fips-3.30 | 3.30.2-r1 |
| Chainguard | calico-whisker-fips-3.30 | 3.30.2-r1 |
| Chainguard | calicoctl-3.30 | 3.30.2-r1 |
| Chainguard | calicoctl-fips-3.30 | 3.30.2-r1 |
| Chainguard | cloud-provider-gcp-cloud-controller-manager | 33.1.1-r2 |
| Chainguard | cloud-provider-gcp-cloud-controller-manager-compat | 33.1.1-r2 |
| Chainguard | cloud-provider-gcp-cloud-controller-manager-fips | 33.1.1-r2 |
| Chainguard | cloud-provider-gcp-cloud-controller-manager-fips-compat | 33.1.1-r2 |
| Chainguard | cluster-autoscaler-1.32 | 1.32.1-r6 |
| Chainguard | cluster-autoscaler-1.32-compat | 1.32.1-r6 |
| Chainguard | cluster-autoscaler-fips-1.32 | 1.32.1-r5 |
| Chainguard | cluster-autoscaler-fips-1.32-compat | 1.32.1-r5 |
| Chainguard | docker-machine-driver-harvester | 1.0.6-r4 |
| Chainguard | emissary | 3.10.0-r6 |
| Chainguard | emissary-apiext | 3.10.0-r6 |
| Chainguard | emissary-fips | 3.10.0-r3 |
| Chainguard | emissary-oci-entrypoint | 3.10.0-r6 |
| Chainguard | kubernetes-csi-driver-hostpath | 1.17.0-r1 |
| Chainguard | longhorn-share-manager-1.8 | 1.8.2-r2 |
| Chainguard | longhorn-share-manager-1.8-compat | 1.8.2-r2 |
| Chainguard | longhorn-share-manager-fips-1.8 | 1.8.2-r3 |
| Chainguard | longhorn-share-manager-fips-1.8-compat | 1.8.2-r3 |
| Chainguard | mesosphere-vsphere-csi | 3.5.0-r1 |
| Chainguard | mesosphere-vsphere-csi-driver | 3.5.0-r1 |
| Chainguard | mesosphere-vsphere-csi-driver-fips | 0 |
| Chainguard | mesosphere-vsphere-csi-syncer | 3.5.0-r1 |
| Chainguard | mesosphere-vsphere-csi-syncer-fips | 0 |
| Chainguard | node-feature-discovery-0.17 | 0.17.3-r3 |
| Chainguard | node-feature-discovery-fips-0.17 | 0.17.3-r2 |
| Chainguard | node-feature-discovery-fips-0.17-gc | 0.17.3-r2 |
| Chainguard | node-feature-discovery-fips-0.17-kubectl-nfd | 0.17.3-r2 |
| Chainguard | node-feature-discovery-fips-0.17-master | 0.17.3-r2 |
| Chainguard | node-feature-discovery-fips-0.17-topology-updater | 0.17.3-r2 |
| Chainguard | node-feature-discovery-fips-0.17-worker | 0.17.3-r2 |
| Chainguard | py3.10-ambassador | 3.10.0-r6 |
| Chainguard | py3.11-ambassador | 3.10.0-r6 |
| Chainguard | py3.12-ambassador | 3.10.0-r6 |
| Chainguard | py3.13-ambassador | 3.10.0-r6 |
| Chainguard | rancher-2.11 | 2.11.2-r2 |
| Chainguard | rancher-2.12 | 2.12.1-r0 |
| Chainguard | rancher-agent-2.11 | 2.11.2-r2 |
| Chainguard | rancher-agent-2.12 | 2.12.1-r0 |
| Chainguard | rancher-fleet | 0.12.4-r1 |
| Chainguard | rancher-fleet-agent | 0.12.4-r1 |
| Chainguard | rancher-fleet-agent-fips | 0.12.4-r1 |
| Chainguard | rancher-fleet-cli | 0.12.4-r1 |
| Chainguard | rancher-fleet-cli-fips | 0.12.4-r1 |
| Chainguard | rancher-fleet-controller | 0.12.4-r1 |
| Chainguard | rancher-fleet-controller-fips | 0.12.4-r1 |
| Chainguard | rancher-fleet-fips | 0.12.4-r1 |
| Chainguard | rancher-fleet-fips-agent | 0.12.4-r1 |
| Chainguard | rancher-fleet-termination-log | 0.12.4-r1 |
| Chainguard | rancher-system-agent | 0.3.12-r3 |
| Chainguard | vcluster | 0.26.0-r1 |
| Chainguard | vcluster-cli | 0.26.0-r1 |
| Chainguard | vcluster-syncer | 0.26.0-r1 |
| Chainguard | yunikorn-k8shim | 1.7.0-r1 |
| Chainguard | yunikorn-k8shim-compat | 1.7.0-r1 |
| Chainguard | yunikorn-k8shim-fips | 1.7.0-r1 |
| Debian:12 | kubernetes | 1.20.5+really1.20.2-1 |
| Debian:13 | kubernetes | 1.20.5+really1.20.2-1 |
| Debian:14 | kubernetes | 1.20.5+really1.20.2-1 |
| Ubuntu:22.04:LTS | kubernetes | no fix |
| Ubuntu:24.04:LTS | kubernetes | no fix |
| Ubuntu:Pro:20.04:LTS | kubernetes | no fix |
| Wolfi | argo-cd-3.0 | 3.0.6-r2 |
| Wolfi | argo-cd-3.0-compat | 3.0.6-r2 |
| Wolfi | argo-cd-3.0-repo-server | 3.0.6-r2 |
| Wolfi | argo-cd-3.1 | 3.1.0-r1 |
| Wolfi | argo-cd-3.1-compat | 3.1.0-r1 |
| Wolfi | argo-cd-3.1-repo-server | 3.1.0-r1 |
| Wolfi | azuredisk-csi-1.33 | 1.33.1-r2 |
| Wolfi | azuredisk-csi-1.33-compat | 1.33.1-r2 |
| Wolfi | azurefile-csi-1.33 | 1.33.2-r1 |
| Wolfi | azurefile-csi-1.33-compat | 1.33.2-r1 |
| Wolfi | blob-csi-1.26 | 1.26.5-r51 |
| Wolfi | blob-csi-1.26-compat | 1.26.5-r51 |
| Wolfi | calico-3.30 | 3.30.2-r1 |
| Wolfi | calico-apiserver-3.30 | 3.30.2-r1 |
| Wolfi | calico-apiserver-compat-3.30 | 3.30.2-r1 |
| Wolfi | calico-app-policy-3.30 | 3.30.2-r1 |
| Wolfi | calico-cni-3.30 | 3.30.2-r1 |
| Wolfi | calico-cni-compat-3.30 | 3.30.2-r1 |
| Wolfi | calico-felix-3.30 | 3.30.2-r1 |
| Wolfi | calico-goldmane-3.30 | 3.30.2-r1 |
| Wolfi | calico-key-cert-provisioner-3.30 | 3.30.2-r1 |
| Wolfi | calico-kube-controllers-3.30 | 3.30.2-r1 |
| Wolfi | calico-node-3.30 | 3.30.2-r1 |
| Wolfi | calico-pod2daemon-3.30 | 3.30.2-r1 |
| Wolfi | calico-pod2daemon-flexvol-compat-3.30 | 3.30.2-r1 |
| Wolfi | calico-typha-client-3.30 | 3.30.2-r1 |
| Wolfi | calico-typhad-3.30 | 3.30.2-r1 |
| Wolfi | calico-whisker-3.30 | 3.30.2-r1 |
| Wolfi | calico-whisker-backend-3.30 | 3.30.2-r1 |
| Wolfi | calicoctl-3.30 | 3.30.2-r1 |
| Wolfi | cloud-provider-gcp-cloud-controller-manager | 33.1.1-r2 |
| Wolfi | cloud-provider-gcp-cloud-controller-manager-compat | 33.1.1-r2 |
| Wolfi | cluster-autoscaler-1.32 | 1.32.1-r6 |
| Wolfi | cluster-autoscaler-1.32-compat | 1.32.1-r6 |
| Wolfi | docker-machine-driver-harvester | 1.0.6-r4 |
| Wolfi | emissary | 3.10.0-r6 |
| Wolfi | emissary-apiext | 3.10.0-r6 |
| Wolfi | emissary-oci-entrypoint | 3.10.0-r6 |
| Wolfi | kubernetes-csi-driver-hostpath | 1.17.0-r1 |
| Wolfi | mesosphere-vsphere-csi | 3.5.0-r1 |
| Wolfi | mesosphere-vsphere-csi-driver | 3.5.0-r1 |
| Wolfi | mesosphere-vsphere-csi-syncer | 3.5.0-r1 |
| Wolfi | node-feature-discovery-0.17 | 0.17.3-r3 |
| Wolfi | py3.10-ambassador | 3.10.0-r6 |
| Wolfi | py3.11-ambassador | 3.10.0-r6 |
| Wolfi | py3.12-ambassador | 3.10.0-r6 |
| Wolfi | py3.13-ambassador | 3.10.0-r6 |
| Wolfi | rancher-2.11 | 2.11.2-r2 |
| Wolfi | rancher-2.12 | 2.12.1-r0 |
| Wolfi | rancher-agent-2.11 | 2.11.2-r2 |
| Wolfi | rancher-agent-2.12 | 2.12.1-r0 |
| Wolfi | rancher-fleet | 0.12.4-r1 |
| Wolfi | rancher-fleet-agent | 0.12.4-r1 |
| Wolfi | rancher-fleet-cli | 0.12.4-r1 |
| Wolfi | rancher-fleet-controller | 0.12.4-r1 |
| Wolfi | rancher-fleet-termination-log | 0.12.4-r1 |
| Wolfi | rancher-system-agent | 0.3.12-r3 |
| Wolfi | vcluster | 0.26.0-r1 |
| Wolfi | vcluster-cli | 0.26.0-r1 |
| Wolfi | vcluster-syncer | 0.26.0-r1 |
| Wolfi | yunikorn-k8shim | 1.7.0-r1 |
| Wolfi | yunikorn-k8shim-compat | 1.7.0-r1 |
| openSUSE:Tumbleweed | govulncheck-vulndb | 0.0.20250730T213748-1.1 |