CVSS 3.1
6.7 mediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:LCVE-2025-5187
Medium (6.7). EPSS 0.6% chance of exploitation in the next 30 days. Fixed in k8s.io/kubernetes 1.31.12, 1.32.8, 1.33.4.
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Severity
- EPSS
- 0.6% chance of exploitation in the next 30 days; higher than 47% of CVEs (scores of 2026-10-31)
- CWE
- CWE-863
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-4x4m-3c2p-qppc | Go | k8s.io/kubernetes | <1.31.12 | 1.31.12 |
| GHSA-4x4m-3c2p-qppc | Go | k8s.io/kubernetes | >=1.32.0-alpha.0 <1.32.8 | 1.32.8 |
| GHSA-4x4m-3c2p-qppc | Go | k8s.io/kubernetes | >=1.33.0-alpha.0 <1.33.4 | 1.33.4 |
| GO-2025-3915 | Go | k8s.io/kubernetes | <1.31.12 >=1.32.0-alpha.0 <1.32.8 >=1.33.0-alpha.0 <1.33.4 | 1.31.12, 1.32.8, 1.33.4 |