VYPR
← All advisories
Medium severity6.7GHSA Advisory· Published Aug 27, 2025· Updated Apr 15, 2026

CVE-2025-5187

CVE-2025-5187

Description

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
k8s.io/kubernetesGo
< 1.31.121.31.12
k8s.io/kubernetesGo
>= 1.32.0-alpha.0, < 1.32.81.32.8
k8s.io/kubernetesGo
>= 1.33.0-alpha.0, < 1.33.41.33.4

Affected products

213

Patches

Vulnerability mechanics

References

5

News mentions

0

No linked articles in our index yet.