CVE-2025-5187

Description

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

CVSS Metrics

• v3.1•MEDIUM•Score: 6.7CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

EPSS Trends

Current EPSS score: 0.54%• Percentile: 44%

Techniques & Countermeasures

• CWE-863•Incorrect Authorization

  The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected Systems

• chainguard•argo-cd-2.13

  < 2.13.8-r5

• chainguard•argo-cd-2.13-compat

  < 2.13.8-r5

• chainguard•argo-cd-2.13-repo-server

  < 2.13.8-r5

• chainguard•argo-cd-2.14

  < 2.14.15-r4

• chainguard•argo-cd-2.14-compat

  < 2.14.15-r4

• chainguard•argo-cd-2.14-repo-server

  < 2.14.15-r4

• chainguard•argo-cd-fips-2.14

  < 2.14.15-r4

• chainguard•argo-cd-fips-2.14-compat

  < 2.14.15-r4

• chainguard•argo-cd-fips-2.14-repo-server

  < 2.14.15-r4

• chainguard•argo-cd-fips-3.0

  < 3.0.13-r1

• chainguard•argo-cd-fips-3.0-compat

  < 3.0.13-r1

• chainguard•argo-cd-fips-3.0-iamguarded-compat

  < 3.0.13-r1

• chainguard•argo-cd-fips-3.0-repo-server

  < 3.0.13-r1

• chainguard•argo-cd-fips-3.1

  < 3.1.1-r1

• chainguard•argo-cd-fips-3.1-compat

  < 3.1.1-r1

• chainguard•argo-cd-fips-3.1-iamguarded-compat

  < 3.1.1-r1

• chainguard•argo-cd-fips-3.1-repo-server

  < 3.1.1-r1

• chainguard•argo-rollouts

  < 1.9.0-r0

• chainguard•argo-rollouts-fips

  < 1.9.0-r0

• chainguard•argocd-image-updater-fips

  < 0.16.0-r8

• chainguard•aws-efs-csi-driver-fips

  < 2.1.11-r1

• chainguard•azure-vnet-cni

  < 1.7.9-r0

• chainguard•azuredisk-csi-1.28

  all

• chainguard•azuredisk-csi-1.29

  all

• chainguard•azuredisk-csi-1.30

  all

• chainguard•azuredisk-csi-1.31

  < 1.31.11-r4

• chainguard•azuredisk-csi-1.31-compat

  < 1.31.11-r4

• chainguard•azuredisk-csi-1.32

  < 1.32.10-r1

• chainguard•azuredisk-csi-1.32-compat

  < 1.32.10-r1

• chainguard•azuredisk-csi-fips-1.28

  all

• chainguard•azuredisk-csi-fips-1.29

  all

• chainguard•azuredisk-csi-fips-1.30

  all

• chainguard•azuredisk-csi-fips-1.31

  < 1.31.11-r3

• chainguard•azuredisk-csi-fips-1.32

  < 1.32.10-r1

• chainguard•azuredisk-csi-fips-1.33

  < 1.33.4-r1

• chainguard•azurefile-csi-1.29

  all

• chainguard•azurefile-csi-1.30

  all

• chainguard•azurefile-csi-1.31

  < 1.31.8-r3

• chainguard•azurefile-csi-1.32

  < 1.32.5-r4

• chainguard•azurefile-csi-1.32-compat

  < 1.32.5-r4

• chainguard•azurefile-csi-fips-1.29

  all

• chainguard•azurefile-csi-fips-1.30

  all

• chainguard•azurefile-csi-fips-1.31

  < 1.31.8-r3 | < 1.31.8-r2

• chainguard•azurefile-csi-fips-1.32

  < 1.32.5-r4

• chainguard•azurefile-csi-fips-1.32-compat

  < 1.32.5-r4

• chainguard•azurefile-csi-fips-1.33

  < 1.33.4-r1

• chainguard•azurefile-csi-fips-1.33-compat

  < 1.33.4-r1

• chainguard•blob-csi-1.23

  < 1.23.11-r61

• chainguard•blob-csi-1.24

  < 1.24.11-r10

• chainguard•blob-csi-fips-1.23

  < 1.23.11-r62

Showing first 50 affected entries in server-rendered view.

References (8)

• https://github.com/kubernetes/kubernetes/issues/133471
• https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE
• https://nvd.nist.gov/vuln/detail/CVE-2025-5187
• https://github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0f
• https://github.com/kubernetes/kubernetes
• https://github.com/advisories/GHSA-4x4m-3c2p-qppc
• https://security-tracker.debian.org/tracker/CVE-2025-5187
• https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5187.json