GHSA-hj2p-8wj8-pfq4

Source

https://github.com/advisories/GHSA-hj2p-8wj8-pfq4

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/06/GHSA-hj2p-8wj8-pfq4/GHSA-hj2p-8wj8-pfq4.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-hj2p-8wj8-pfq4

Aliases

CVE-2025-4563

Related

Published

2025-06-23T18:30:26Z

Modified

2025-06-23T23:42:18.187260Z

Downstream

MINI-p429-4pfr-6c3g

Severity

2.7 (Low) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L CVSS Calculator

Summary

kubernetes allows nodes to bypass dynamic resource allocation authorization checks

Details

A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.

Database specific

{
    "nvd_published_at": "2025-06-23T16:15:27Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "severity": "LOW",
    "github_reviewed": true,
    "github_reviewed_at": "2025-06-23T22:41:38Z"
}

References

Affected packages

Go / k8s.io/kubernetes

Package

Name: k8s.io/kubernetes; View open source insights on deps.dev
Purl: pkg:golang/k8s.io/kubernetes

Affected ranges

Type: SEMVER
Events: Introduced

1.32.0

Fixed

1.32.6

Database specific

{
    "last_known_affected_version_range": "<= 1.32.5"
}

Go / k8s.io/kubernetes

Package

Name: k8s.io/kubernetes; View open source insights on deps.dev
Purl: pkg:golang/k8s.io/kubernetes

Affected ranges

Type: SEMVER
Events: Introduced

1.33.0

Fixed

1.33.2

Database specific

{
    "last_known_affected_version_range": "<= 1.33.1"
}