CVE-2025-4563

What it actually does

The NodeRestriction admission controller skips dynamic resource allocation claim status validation on pod creation (when the feature gate is enabled), permitting nodes to instantiate mirror pods that reference unauthorized claims.

Why it matters to the business

A compromised worker node can obtain unauthorized access to cluster resources, increasing the chance of lateral movement and privilege escalation inside container orchestration environments.

How an attack unfolds

An attacker first gains control of a Kubernetes node, then submits a pod creation request containing a dynamic resource claim; because validation is absent at creation time the admission controller accepts the request, allowing the resulting mirror pod to bind and use resources that should have been denied.

How to fix it

Upgrade affected Kubernetes control-plane components to a release containing the corrected NodeRestriction logic; if immediate patching is impossible, disable the DynamicResourceAllocation feature gate until the fix can be applied.

How to confirm the fix worked

Review admission controller source or running binary for the corrected claim-status check on pod creation; confirm that attempts to create mirror pods with unauthorized claims are now rejected in test clusters.

Typical attack path

1. Compromise a cluster node with sufficient privileges to create pods
2. Ensure the DynamicResourceAllocation feature gate is enabled on the API server
3. Craft and submit a pod creation manifest referencing an unauthorized resource claim
4. Observe successful scheduling of the mirror pod that now accesses the restricted resource

How to detect it

Search Kubernetes audit logs for pod creation events initiated by node identities that reference dynamic resource claims; correlate with API server logs showing absence of claim-status validation errors on creation versus status-update paths.

What your security team should do

• Prioritize upgrade of control-plane nodes to the fixed release within the next maintenance window
• Audit cluster configurations for unintended enablement of the DynamicResourceAllocation feature gate
• Add policy or admission webhook rules that explicitly block mirror-pod creation by nodes until patches are deployed