PT-2025-26210 · Unknown+2 · Kubernetes+1

Amitschendel · Published 2025-06-19 · Updated 2025-08-04 · CVE-2025-4563

Positive Technologies (AI Summary)

CVSS v3.1

2.7

Low

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions kube-apiserver versions 1.32.0 through 1.32.5 kube-apiserver versions 1.33.0 through 1.33.1

Description The issue allows a compromised node to create mirror pods, accessing unauthorized dynamic resources, potentially leading to privilege escalation. This occurs when using the DynamicResourceAllocation feature gate.

Recommendations For kube-apiserver versions 1.32.0 through 1.32.5, update to version 1.32.6 or later. For kube-apiserver versions 1.33.0 through 1.33.1, update to version 1.33.2 or later. As a temporary mitigation measure, consider disabling the DynamicResourceAllocation feature gate until a patch is available.

Fix

LPE

Incorrect Authorization

RCE

Weakness Enumeration

CWE-863

CWE-20

Related Identifiers

ALT-PU-2025-8449

ALT-PU-2025-8450

ALT-PU-2025-9445

ALT-PU-2025-9447

AZL-64304

CVE-2025-4563

GHSA-HJ2P-8WJ8-PFQ4

GO-2025-3774

OPENSUSE-SU-2025:15405-1

Affected Products

Alt Linux

Kubernetes

References · 93

• https://osv.dev/vulnerability/GHSA-hj2p-8wj8-pfq4 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-4563 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-4563 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-4563 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-4563 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-4563 · Vendor Advisory
• https://osv.dev/vulnerability/AZL-64304 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2025:15405-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-4563 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-4563 · Security Note
• https://osv.dev/vulnerability/GO-2025-3774 · Vendor Advisory
• https://github.com/kubernetes/kubernetes · Note
• https://github.com/kubernetes/kubernetes/issues/132151 · Note
• https://github.com/kubernetes/kubernetes/pull/131844 · Note
• https://github.com/kubernetes/kubernetes/pull/131876 · Note