2.7

CVE-2025-4563: kubernetes Improper Input Validation

CVSS: 2.7v3.1LowDeferred
AliasesUBUNTU-CVE-2025-4563DEBIAN-CVE-2025-4563CGA-2r57-rq2w-78p5
Published 23-06-2025Last modified 23-06-2025
Open JSON

Vulnerability summary

CVE-2025-4563 is a low (CVSS 2.7) Improper Input Validation vulnerability in kubernetes. EPSS estimates a 0.83% chance of exploitation in the next 30 days, higher than 56.8% of scored vulnerabilities.

Overall risk
11/100
0100
Low · default modelHow is this calculated?
CVSS score
2.7/10
010
Low · v3.1 (CVE.org)
EPSS score
0.83%
0%100%
Low · +0.17 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 1 · Related 23
OPENSUSE-SU-2025:15405-1CGA-5FQX-PR25-FWW4CGA-6H7C-72XP-2WMWCGA-7JQQ-QQV5-RH8MCGA-834G-XVHM-RWM4CGA-88P7-RC7R-RQF7

Timeline

  1. 23-06-2025
    PublishedVulnerability first disclosed.
  2. 23-06-2025
    Last modifiedVulnerability information updated.

Description

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.83%

Chance of exploitation in the next 30 days

Percentile

57%

Versus all other CVEs

30-day change

+0.17 pp

From 0.66% on 20-09-2026

20-09-202620-10-2026
EPSS score
0.83%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

Affected systems

Chainguard119 products
  • argo-cd-3.0< 3.0.6-r2
  • argo-cd-3.0-compat< 3.0.6-r2
  • argo-cd-3.0-iamguarded-compat< 3.0.6-r2
  • argo-cd-3.0-repo-server< 3.0.6-r2
  • argo-cd-3.1< 3.1.0-r1
Wolfi25 products
  • cloud-provider-gcp-cloud-controller-manager< 33.1.1-r2
  • cloud-provider-gcp-cloud-controller-manager-compat< 33.1.1-r2
  • docker-machine-driver-harvester< 1.0.6-r4
  • emissary< 3.10.0-r6
  • emissary-apiext< 3.10.0-r6
Debian1 product
  • kubernetes< 1.20.5+really1.20.2-1
K8s.io1 product
  • kubernetes≥ 1.32.0, < 1.32.6 | ≥ 1.33.0, < 1.33.2
Kubernetes1 product
Ubuntu1 product
  • kubernetesAll versions (No fix recorded)

6 vendors · 148 products

References

13 links
Show all 13 references