CVE-2025-4563

Name of the Vulnerable Software and Affected Versions kube-apiserver versions 1.32.0 through 1.32.5 kube-apiserver versions 1.33.0 through 1.33.1

Description The issue allows a compromised node to create mirror pods, accessing unauthorized dynamic resources, potentially leading to privilege escalation. This occurs when using the DynamicResourceAllocation feature gate.

Recommendations For kube-apiserver versions 1.32.0 through 1.32.5, update to version 1.32.6 or later. For kube-apiserver versions 1.33.0 through 1.33.1, update to version 1.33.2 or later. As a temporary mitigation measure, consider disabling the DynamicResourceAllocation feature gate until a patch is available.