CVE-2025-5187
Fixed in a distro release EPSS <1%CVSS 6.7
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Products: Kubernetes
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Go | k8s.io/kubernetes | 1.31.12 |
| Go | k8s.io/kubernetes | 1.32.8 |
| Go | k8s.io/kubernetes | 1.33.4 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | argo-cd-2.13 | 2.13.8-r5 |
| Chainguard | argo-cd-2.13-compat | 2.13.8-r5 |
| Chainguard | argo-cd-2.13-repo-server | 2.13.8-r5 |
| Chainguard | argo-cd-2.14 | 2.14.15-r4 |
| Chainguard | argo-cd-2.14-compat | 2.14.15-r4 |
| Chainguard | argo-cd-2.14-repo-server | 2.14.15-r4 |
| Chainguard | argo-cd-fips-2.13-compat | 2.13.9-r3 |
| Chainguard | argo-cd-fips-2.14 | 2.14.15-r4 |
| Chainguard | argo-cd-fips-2.14-compat | 2.14.15-r4 |
| Chainguard | argo-cd-fips-2.14-repo-server | 2.14.15-r4 |
| Chainguard | argo-cd-fips-3.0 | 3.0.13-r1 |
| Chainguard | argo-cd-fips-3.0-compat | 3.0.13-r1 |
| Chainguard | argo-cd-fips-3.0-iamguarded-compat | 3.0.13-r1 |
| Chainguard | argo-cd-fips-3.0-repo-server | 3.0.13-r1 |
| Chainguard | argo-cd-fips-3.1 | 3.1.1-r1 |
| Chainguard | argo-cd-fips-3.1-compat | 3.1.1-r1 |
| Chainguard | argo-cd-fips-3.1-iamguarded-compat | 3.1.1-r1 |
| Chainguard | argo-cd-fips-3.1-repo-server | 3.1.1-r1 |
| Chainguard | argo-rollouts | 1.9.0-r0 |
| Chainguard | argo-rollouts-fips | 1.9.0-r0 |
| Chainguard | argocd-image-updater-fips | 0.16.0-r8 |
| Chainguard | aws-efs-csi-driver-fips | 2.1.11-r1 |
| Chainguard | azure-vnet-cni | 1.7.9-r0 |
| Chainguard | azuredisk-csi-1.28 | no fix |
| Chainguard | azuredisk-csi-1.29 | no fix |
| Chainguard | azuredisk-csi-1.30 | no fix |
| Chainguard | azuredisk-csi-1.31 | 1.31.11-r4 |
| Chainguard | azuredisk-csi-1.31-compat | 1.31.11-r4 |
| Chainguard | azuredisk-csi-1.32 | 1.32.10-r1 |
| Chainguard | azuredisk-csi-1.32-compat | 1.32.10-r1 |
| Chainguard | azuredisk-csi-fips-1.28 | no fix |
| Chainguard | azuredisk-csi-fips-1.29 | no fix |
| Chainguard | azuredisk-csi-fips-1.30 | no fix |
| Chainguard | azuredisk-csi-fips-1.31 | 1.31.11-r3 |
| Chainguard | azuredisk-csi-fips-1.32 | 1.32.10-r1 |
| Chainguard | azuredisk-csi-fips-1.33 | 1.33.4-r1 |
| Chainguard | azurefile-csi-1.29 | no fix |
| Chainguard | azurefile-csi-1.30 | no fix |
| Chainguard | azurefile-csi-1.31 | 1.31.8-r3 |
| Chainguard | azurefile-csi-1.32 | 1.32.5-r4 |
| Chainguard | azurefile-csi-1.32-compat | 1.32.5-r4 |
| Chainguard | azurefile-csi-fips-1.29 | no fix |
| Chainguard | azurefile-csi-fips-1.30 | no fix |
| Chainguard | azurefile-csi-fips-1.31 | 1.31.8-r2 |
| Chainguard | azurefile-csi-fips-1.31 | 1.31.8-r3 |
| Chainguard | azurefile-csi-fips-1.32 | 1.32.5-r4 |
| Chainguard | azurefile-csi-fips-1.32-compat | 1.32.5-r4 |
| Chainguard | azurefile-csi-fips-1.33 | 1.33.4-r1 |
| Chainguard | azurefile-csi-fips-1.33-compat | 1.33.4-r1 |
| Chainguard | blob-csi-1.23 | 1.23.11-r61 |
| Chainguard | blob-csi-1.24 | 1.24.11-r10 |
| Chainguard | blob-csi-fips-1.23 | 1.23.11-r62 |
| Chainguard | blob-csi-fips-1.24 | 1.24.11-r10 |
| Chainguard | blob-csi-fips-1.25 | 1.25.9-r5 |
| Chainguard | blob-csi-fips-1.25-compat | 1.25.9-r5 |
| Chainguard | blob-csi-fips-1.26 | 1.26.7-r1 |
| Chainguard | blob-csi-fips-1.26-compat | 1.26.7-r1 |
| Chainguard | calico-apiserver-3.29 | no fix |
| Chainguard | calico-apiserver-fips-3.29 | no fix |
| Chainguard | calico-felix-3.29 | no fix |
| Chainguard | calico-felix-fips-3.29 | no fix |
| Chainguard | calico-node-3.29 | no fix |
| Chainguard | calico-node-fips-3.29 | no fix |
| Chainguard | cephcsi | 3.15.0-r2 |
| Chainguard | cephcsi-compat | 3.15.0-r2 |
| Chainguard | cephcsi-fips | 3.15.0-r2 |
| Chainguard | cluster-autoscaler-1.31 | 1.31.3-r3 |
| Chainguard | cluster-autoscaler-1.31-compat | 1.31.3-r3 |
| Chainguard | cluster-autoscaler-fips-1.31 | 1.31.3-r4 |
| Chainguard | cluster-autoscaler-fips-1.31-compat | 1.31.3-r4 |
| Chainguard | cluster-autoscaler-fips-1.33 | 1.33.0-r4 |
| Chainguard | cluster-autoscaler-fips-1.33-compat | 1.33.0-r4 |
| Chainguard | docker-machine-driver-harvester | 1.0.3-r3 |
| Chainguard | docker-machine-driver-harvester | 1.0.6-r4 |
| Chainguard | eks-distro-kube-apiserver-1.29 | no fix |
| Chainguard | eks-distro-kube-apiserver-1.30 | no fix |
| Chainguard | eks-distro-kube-apiserver-1.31 | 1.31.35-r1 |
| Chainguard | eks-distro-kube-apiserver-1.32 | 1.32.28-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.29 | no fix |
| Chainguard | eks-distro-kube-apiserver-fips-1.30 | no fix |
| Chainguard | eks-distro-kube-apiserver-fips-1.31 | 1.31.35-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.32 | 1.32.28-r1 |
| Chainguard | eks-distro-kube-apiserver-fips-1.32 | 1.32.28-r0 |
| Chainguard | eks-distro-kube-controller-manager-1.29 | no fix |
| Chainguard | eks-distro-kube-controller-manager-1.30 | no fix |
| Chainguard | eks-distro-kube-controller-manager-fips-1.29 | no fix |
| Chainguard | eks-distro-kube-controller-manager-fips-1.30 | no fix |
| Chainguard | eks-distro-kube-proxy-1.29 | no fix |
| Chainguard | eks-distro-kube-proxy-1.30 | no fix |
| Chainguard | eks-distro-kube-proxy-fips-1.29 | no fix |
| Chainguard | eks-distro-kube-proxy-fips-1.30 | no fix |
| Chainguard | eks-distro-kube-scheduler-1.29 | no fix |
| Chainguard | eks-distro-kube-scheduler-1.30 | no fix |
| Chainguard | eks-distro-kube-scheduler-fips-1.29 | no fix |
| Chainguard | eks-distro-kube-scheduler-fips-1.30 | no fix |
| Chainguard | emissary | 3.10.0-r9 |
| Chainguard | emissary-apiext | 3.10.0-r9 |
| Chainguard | emissary-oci-entrypoint | 3.10.0-r9 |
| Chainguard | ip-masq-agent | 2.12.0-r12 |
| Chainguard | k8ssandra-client | 0.8.2-r2 |
| Chainguard | k8ssandra-client-compat | 0.8.2-r2 |
| Chainguard | k8ssandra-client-fips | 0.8.2-r2 |
| Chainguard | kapp | 0.64.2-r3 |
| Chainguard | kapp-fips | 0.64.2-r5 |
| Chainguard | kube-apiserver-1.32 | 1.32.11-r0 |
| Chainguard | kube-apiserver-1.32-default | 1.32.11-r0 |
| Chainguard | kube-apiserver-1.32-default-compat | 1.32.11-r0 |
| Chainguard | kube-controller-manager-1.32 | 1.32.11-r0 |
| Chainguard | kube-controller-manager-1.32-default | 1.32.11-r0 |
| Chainguard | kube-controller-manager-1.32-default-compat | 1.32.11-r0 |
| Chainguard | kube-proxy-1.32 | 1.32.11-r0 |
| Chainguard | kube-proxy-1.32-default | 1.32.11-r0 |
| Chainguard | kube-proxy-1.32-default-compat | 1.32.11-r0 |
| Chainguard | kube-scheduler-1.32 | 1.32.11-r0 |
| Chainguard | kube-scheduler-1.32-default | 1.32.11-r0 |
| Chainguard | kube-scheduler-1.32-default-compat | 1.32.11-r0 |
| Chainguard | kubeadm-1.32 | 1.32.11-r0 |
| Chainguard | kubeadm-1.32-default | 1.32.11-r0 |
| Chainguard | kubeadm-1.32-default-compat | 1.32.11-r0 |
| Chainguard | kubectl-1.30 | no fix |
| Chainguard | kubectl-1.32 | 1.32.11-r0 |
| Chainguard | kubectl-1.32-default | 1.32.11-r0 |
| Chainguard | kubectl-1.32-default-compat | 1.32.11-r0 |
| Chainguard | kubectl-1.32-iamguarded-compat | 1.32.11-r0 |
| Chainguard | kubectl-argo-rollouts | 1.9.0-r0 |
| Chainguard | kubectl-argo-rollouts-fips | 1.9.0-r0 |
| Chainguard | kubectl-bash-completion-1.32 | 1.32.11-r0 |
| Chainguard | kubelet-1.32 | 1.32.11-r0 |
| Chainguard | kubelet-1.32-default | 1.32.11-r0 |
| Chainguard | kubelet-1.32-default-compat | 1.32.11-r0 |
| Chainguard | kubernetes-1.30 | no fix |
| Chainguard | kubernetes-1.32 | 1.32.11-r0 |
| Chainguard | kubernetes-1.32-default | 1.32.11-r0 |
| Chainguard | kubernetes-csi-driver-hostpath | 1.17.0-r4 |
| Chainguard | kubernetes-csi-driver-nfs | 4.11.0-r6 |
| Chainguard | kubernetes-csi-driver-nfs-compat | 4.11.0-r6 |
| Chainguard | kubernetes-csi-driver-nfs-fips | 4.11.0-r6 |
| Chainguard | kubernetes-csi-driver-nfs-fips-compat | 4.11.0-r6 |
| Chainguard | kubernetes-dns-node-cache | 1.26.7-r0 |
| Chainguard | kubernetes-dns-node-cache-fips | 1.26.7-r1 |
| Chainguard | kubernetes-pause-1.32 | 1.32.11-r0 |
| Chainguard | kubernetes-pause-compat-1.32 | 1.32.11-r0 |
| Chainguard | local-static-provisioner | 2.9.0-r0 |
| Chainguard | local-static-provisioner-fips | 2.9.0-r0 |
| Chainguard | local-volume-node-cleanup | 2.9.0-r0 |
| Chainguard | local-volume-node-cleanup-compat | 2.9.0-r4 |
| Chainguard | local-volume-node-cleanup-fips | 2.9.0-r0 |
| Chainguard | longhorn-share-manager-1.8 | 1.8.2-r2 |
| Chainguard | longhorn-share-manager-1.8-compat | 1.8.2-r2 |
| Chainguard | longhorn-share-manager-fips-1.8 | 1.8.2-r3 |
| Chainguard | longhorn-share-manager-fips-1.8-compat | 1.8.2-r3 |
| Chainguard | mesosphere-vsphere-csi | 3.5.0-r2 |
| Chainguard | mesosphere-vsphere-csi-driver | 3.5.0-r2 |
| Chainguard | mesosphere-vsphere-csi-driver-fips | 0 |
| Chainguard | mesosphere-vsphere-csi-syncer | 3.5.0-r2 |
| Chainguard | mesosphere-vsphere-csi-syncer-fips | 0 |
| Chainguard | node-feature-discovery-0.16 | 0.16.9-r2 |
| Chainguard | node-feature-discovery-fips-0.16-kubectl-nfd | 0.16.9-r2 |
| Chainguard | node-feature-discovery-fips-0.17 | 0.17.3-r4 |
| Chainguard | node-feature-discovery-fips-0.17-gc | 0.17.3-r4 |
| Chainguard | node-feature-discovery-fips-0.17-kubectl-nfd | 0.17.3-r4 |
| Chainguard | node-feature-discovery-fips-0.17-master | 0.17.3-r4 |
| Chainguard | node-feature-discovery-fips-0.17-topology-updater | 0.17.3-r4 |
| Chainguard | node-feature-discovery-fips-0.17-worker | 0.17.3-r4 |
| Chainguard | nodetaint | 0.0.4-r36 |
| Chainguard | py3.10-ambassador | 3.10.0-r9 |
| Chainguard | py3.11-ambassador | 3.10.0-r9 |
| Chainguard | py3.12-ambassador | 3.10.0-r9 |
| Chainguard | py3.13-ambassador | 3.10.0-r9 |
| Chainguard | rancher-2.10 | 2.10.9-r1 |
| Chainguard | rancher-2.11 | 2.11.5-r0 |
| Chainguard | rancher-2.12 | 2.12.1-r0 |
| Chainguard | rancher-agent-2.10 | 2.10.9-r1 |
| Chainguard | rancher-agent-2.11 | 2.11.5-r0 |
| Chainguard | rancher-agent-2.12 | 2.12.1-r0 |
| Chainguard | rancher-agent-2.9 | no fix |
| Chainguard | rancher-system-agent | 0.3.13-r2 |
| Chainguard | rancher-webhook-0.4 | no fix |
| Chainguard | rancher-webhook-0.5 | no fix |
| Chainguard | rancher-webhook-0.6 | 0.6.10-r1 |
| Chainguard | rancher-webhook-fips-0.4 | no fix |
| Chainguard | rancher-webhook-fips-0.5 | no fix |
| Chainguard | rancher-webhook-fips-0.6 | 0.6.10-r1 |
| Chainguard | vcluster | 0.27.0-r2 |
| Chainguard | vcluster-cli | 0.27.0-r2 |
| Chainguard | vcluster-syncer | 0.27.0-r2 |
| Chainguard | yunikorn-k8shim | 1.7.0-r3 |
| Chainguard | yunikorn-k8shim-fips | 1.7.0-r4 |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 |
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 |
| SUSE Linux Enterprise Module for Package Hub 15 SP6 | govulncheck-vulndb | 0.0.20250918T182144-150000.1.107.1 |
| Wolfi | argo-rollouts | 1.9.0-r0 |
| Wolfi | docker-machine-driver-harvester | 1.0.3-r3 |
| Wolfi | docker-machine-driver-harvester | 1.0.6-r4 |
| Wolfi | emissary | 3.10.0-r9 |
| Wolfi | emissary-apiext | 3.10.0-r9 |
| Wolfi | emissary-oci-entrypoint | 3.10.0-r9 |
| Wolfi | ip-masq-agent | 2.12.0-r12 |
| Wolfi | k8ssandra-client | 0.8.2-r2 |
| Wolfi | k8ssandra-client-compat | 0.8.2-r2 |
| Wolfi | kapp | 0.64.2-r3 |
| Wolfi | kubectl-1.30 | no fix |
| Wolfi | kubectl-1.32 | 1.32.11-r0 |
| Wolfi | kubectl-1.32-default | 1.32.11-r0 |
| Wolfi | kubectl-argo-rollouts | 1.9.0-r0 |
| Wolfi | kubernetes-csi-driver-hostpath | 1.17.0-r4 |
| Wolfi | kubernetes-csi-driver-nfs | 4.11.0-r6 |
| Wolfi | kubernetes-csi-driver-nfs-compat | 4.11.0-r6 |
| Wolfi | kubernetes-dns-node-cache | 1.26.7-r0 |
| Wolfi | local-static-provisioner | 2.9.0-r0 |
| Wolfi | local-volume-node-cleanup | 2.9.0-r0 |
| Wolfi | local-volume-node-cleanup-compat | 2.9.0-r4 |
| Wolfi | mesosphere-vsphere-csi | 3.5.0-r2 |
| Wolfi | mesosphere-vsphere-csi-driver | 3.5.0-r2 |
| Wolfi | mesosphere-vsphere-csi-syncer | 3.5.0-r2 |
| Wolfi | nodetaint | 0.0.4-r36 |
| Wolfi | py3.10-ambassador | 3.10.0-r9 |
| Wolfi | py3.11-ambassador | 3.10.0-r9 |
| Wolfi | py3.12-ambassador | 3.10.0-r9 |
| Wolfi | py3.13-ambassador | 3.10.0-r9 |
| Wolfi | rancher-2.12 | 2.12.1-r0 |
| Wolfi | rancher-system-agent | 0.3.13-r2 |
| Wolfi | rancher-webhook-0.6 | 0.6.10-r1 |
| Wolfi | vcluster | 0.27.0-r2 |
| Wolfi | vcluster-cli | 0.27.0-r2 |
| Wolfi | vcluster-syncer | 0.27.0-r2 |
| Wolfi | yunikorn-k8shim | 1.7.0-r3 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20250918T182144-150000.1.107.1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 |
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250918T182144-1.1 |