A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the controller properly validates resource claim statuses during pod status updates but fails to perform equivalent validation during pod creation. This allows a compromised node to create mirror pods that access unauthorized dynamic resources, potentially leading to privilege escalation.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource     allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the     controller properly validates resource claim statuses during pod status updates but fails to perform     equivalent validation during pod creation. This allows a compromised node to create mirror pods that     access unauthorized dynamic resources, potentially leading to privilege escalation. (CVE-2025-4563)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource
    allocation authorization checks. When the DynamicResourceAllocation feature gate is enabled, the
    controller properly validates resource claim statuses during pod status updates but fails to perform
    equivalent validation during pod creation. This allows a compromised node to create mirror pods that
    access unauthorized dynamic resources, potentially leading to privilege escalation. (CVE-2025-4563)

The remote Fedora 42 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-b8463b0972 advisory.

    Update to release v1.32.6

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-509fc3c663 advisory.

    Update to release v1.32.6

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Fedora 43 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2025-4df998d449 advisory.

    Automatic update for kubernetes1.32-1.32.6-1.fc43.

    ##### **Changelog**

    ```
    * Thu Jun 19 2025 Bradley G Smith <bradley.g.smith@gmail.com> - 1.32.6-1
    - Update to release v1.32.6
    - Resolves: rhbz#2373848,rhbz#2373847
    - Resolves: CVE-2025-4563
    - Upstream fixes and cleanups

    ```

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
258238	Linux Distros Unpatched Vulnerability : CVE-2025-4563	Nessus	Misc.	low
431703	SCA: security update for k8s.io/kubernetes (GHSA-hj2p-8wj8-pfq4)	Tenable Cloud Security	SCA Checks	low
431703	SCA: security update for k8s.io/kubernetes (GHSA-hj2p-8wj8-pfq4)	Tenable Self-Hosted Container Security	SCA Checks	low
241072	Fedora 42 : kubernetes1.32 (2025-b8463b0972)	Nessus	Fedora Local Security Checks	low
240914	Fedora 41 : kubernetes1.32 (2025-509fc3c663)	Nessus	Fedora Local Security Checks	low
240194	Fedora 43 : kubernetes1.32 (2025-4df998d449)	Nessus	Fedora Local Security Checks	critical

Detections

Analytics

CVE-2025-4563

low

Tenable Plugins

low

low

low

low

low

critical