Database/Container, Kubernetes & orchestration
Kubernetes (kube-apiserver): Nodes can bypass DRA authorization checks
CVSS 2.7CVE-2025-4563Container, Kubernetes & orchestrationcurated
Impact
Nodes can bypass DRA authorization checks. Directly relevant: DRA is how GPUs are allocated in modern clusters
Who can reach it
A compromised node / kubelet credential
What to do
Rolling control-plane upgrade; no GPU drain, but re-audit DRA ResourceClaim allocations
References
Related entries
- Kubernetes (kube-apiserver): TOCTOU/DNS-rebinding bypass of the link-local and localhost proxy protectionsCVE-2020-8562 · Kubernetes (kube-apiserver)Low
- Kubernetes (kube-apiserver): Cluster-scoped custom resources reachable through namespaced requests, so namespace-scopedCVE-2019-11247 · Kubernetes (kube-apiserver)High
- Kubernetes (kube-apiserver): "Billion laughs": malicious YAML/JSON payload consumes all apiserver memoryCVE-2019-11253 · Kubernetes (kube-apiserver)High
- Kubernetes (kube-apiserver): A node can delete itself, and cascade-delete other objects, by adding an OwnerReferenceCVE-2025-5187 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Node address not verified when proxyingCVE-2022-3294 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): YAML parsing CPU exhaustion in the apiserverCVE-2019-11254 · Kubernetes (kube-apiserver)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.