Cloudanix VulnDB

CVE-2025-5187

Medium · 6.7

CVSS

6.7

EPSS

0.6%

Published

Aug 27, 2025

CISA due date

—

Cloudanix analysis

Monitor only SSVC: Track

A configuration mistake lets certain system users delete important machine records they should not touch, which can knock parts of the computing environment offline.

Exploitation
Remote Authenticated
Attacker needs
High Privilege
Complexity
Moderate
Impact
Data Tampering
Component
Other
Class
Authorization Bypass
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

NodeRestriction admission controller fails to block a node user from adding an OwnerReference to a non-existent cluster-scoped resource on its own Node object, allowing subsequent garbage collection to delete the Node.

Why it matters to the business

Attackers with node-level credentials can cause unauthorized removal of nodes, leading to workload disruption, availability loss, and potential cluster instability; the issue affects Kubernetes environments and has low but slowly rising exploit probability.

How an attack unfolds

An authenticated node user crafts a patch that attaches an OwnerReference pointing to a non-existent cluster-scoped object; when that reference is deleted or never created, the garbage collector removes the Node object, bypassing intended authorization controls.

How to fix it

Upgrade affected Kubernetes components to a version containing the NodeRestriction fix; for the listed package ninofiliu/interactive-git-checkout (GIT) apply the change in commit 8dd832dd302af287a61611f4f85e157cd1c6bb41.

How to confirm the fix worked

Confirm the admission controller rejects OwnerReference patches on Node objects that reference non-existent cluster-scoped resources; review Node API audit logs for unauthorized OwnerReference modifications and verify garbage-collection events do not delete nodes unexpectedly.

Typical attack path

  1. Obtain node-level credentials or compromise a node service account
  2. Issue a patch request against the Node API adding an OwnerReference to a chosen cluster-scoped resource
  3. Ensure the referenced resource does not exist or delete it after the patch
  4. Trigger or wait for garbage collection to delete the Node object

How to detect it

Search Kubernetes audit logs for patch operations on nodes that add OwnerReference fields; look for subsequent garbage-collection delete events on those same nodes and correlate with service-account activity.

What your security team should do

  • Apply the fixed commit or equivalent Kubernetes patch immediately given the 425-day exposure window
  • Audit all node service accounts and restrict permissions to the minimum required
  • Enable or verify strict NodeRestriction enforcement and monitor for OwnerReference changes on Node objects
  • Review cluster audit logs for the past 30 days for suspicious Node patches

The record

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

Affected packages

Ecosystem Package Introduced Fixed
Go k8s.io/kubernetes 0 1.31.12
Go k8s.io/kubernetes 1.32.0-alpha.0 1.32.8
Go k8s.io/kubernetes 1.33.0-alpha.0 1.33.4
Chainguard argo-cd-2.13 0 2.13.8-r5
Chainguard argo-cd-2.13-compat 0 2.13.8-r5
Chainguard argo-cd-2.13-repo-server 0 2.13.8-r5
Chainguard argo-cd-2.14 0 2.14.15-r4
Chainguard argo-cd-2.14-compat 0 2.14.15-r4
Chainguard argo-cd-2.14-repo-server 0 2.14.15-r4
Chainguard argo-cd-fips-2.13 0 2.13.9-r3
Chainguard argo-cd-fips-2.13-compat 0 2.13.9-r3
Chainguard argo-cd-fips-2.13-repo-server 0 2.13.9-r3
Chainguard argo-cd-fips-2.14 0 2.14.15-r4
Chainguard argo-cd-fips-2.14-compat 0 2.14.15-r4
Chainguard argo-cd-fips-2.14-repo-server 0 2.14.15-r4
Chainguard argo-cd-fips-3.0 0 3.0.13-r1
Chainguard argo-cd-fips-3.0-compat 0 3.0.13-r1
Chainguard argo-cd-fips-3.0-iamguarded-compat 0 3.0.13-r1
Chainguard argo-cd-fips-3.0-repo-server 0 3.0.13-r1
Chainguard argo-cd-fips-3.1 0 3.1.1-r1
Chainguard argo-cd-fips-3.1-compat 0 3.1.1-r1
Chainguard argo-cd-fips-3.1-iamguarded-compat 0 3.1.1-r1
Chainguard argo-cd-fips-3.1-repo-server 0 3.1.1-r1
Chainguard argo-rollouts 0 1.9.0-r0
Chainguard argo-rollouts-fips 0 1.9.0-r0
Chainguard argocd-image-updater-fips 0 0.16.0-r8
Chainguard aws-efs-csi-driver-fips 0 2.1.11-r1
Chainguard azure-container-networking 0 1.7.4-r3
Chainguard azure-vnet-cni 0 1.7.9-r0
Chainguard azuredisk-csi-1.28-compat 0 1.28.12-r9
Chainguard azuredisk-csi-1.29-compat 0 1.29.14-r9
Chainguard azuredisk-csi-1.30-compat 0 1.30.12-r7
Chainguard azuredisk-csi-1.31 0 1.31.11-r4
Chainguard azuredisk-csi-1.31-compat 0 1.31.11-r4
Chainguard azuredisk-csi-1.32 0 1.32.10-r1
Chainguard azuredisk-csi-1.32-compat 0 1.32.10-r1
Chainguard azuredisk-csi-fips-1.31 0 1.31.11-r3
Chainguard azuredisk-csi-fips-1.32 0 1.32.10-r1
Chainguard azuredisk-csi-fips-1.33 0 1.33.4-r1
Chainguard azurefile-csi-1.29-compat 0 1.29.12-r7
Chainguard azurefile-csi-1.30-compat 0 1.30.10-r6
Chainguard azurefile-csi-1.31 0 1.31.8-r3
Chainguard azurefile-csi-1.31-compat 0 1.31.8-r3
Chainguard azurefile-csi-1.32 0 1.32.5-r4
Chainguard azurefile-csi-1.32-compat 0 1.32.5-r4
Chainguard azurefile-csi-fips-1.29-compat 0 1.29.12-r7
Chainguard azurefile-csi-fips-1.30-compat 0 1.30.10-r7
Chainguard azurefile-csi-fips-1.31 0 1.31.8-r3
Chainguard azurefile-csi-fips-1.31-compat 0 1.31.8-r3
Chainguard azurefile-csi-fips-1.32 0 1.32.5-r4
Chainguard azurefile-csi-fips-1.32-compat 0 1.32.5-r4
Chainguard azurefile-csi-fips-1.33 0 1.33.4-r1
Chainguard azurefile-csi-fips-1.33-compat 0 1.33.4-r1
Chainguard blob-csi-1.23 0 1.23.11-r61
Chainguard blob-csi-1.23-compat 0 1.23.11-r56
Chainguard blob-csi-1.24 0 1.24.11-r10
Chainguard blob-csi-1.24-compat 0 1.24.11-r6
Chainguard blob-csi-fips-1.23 0 1.23.11-r62
Chainguard blob-csi-fips-1.23-compat 0 1.23.11-r58
Chainguard blob-csi-fips-1.24 0 1.24.11-r10
Chainguard blob-csi-fips-1.24-compat 0 1.24.11-r6
Chainguard blob-csi-fips-1.25 0 1.25.9-r5
Chainguard blob-csi-fips-1.25-compat 0 1.25.9-r5
Chainguard blob-csi-fips-1.26 0 1.26.7-r1
Chainguard blob-csi-fips-1.26-compat 0 1.26.7-r1
Chainguard calico-3.29 0 3.29.6-r1
Chainguard calico-apiserver-compat-3.29 0 3.29.6-r1
Chainguard calico-app-policy-3.29 0 3.29.6-r1
Chainguard calico-app-policy-fips-3.29 0 3.29.6-r1
Chainguard calico-cni-3.29 0 3.29.6-r1
Chainguard calico-cni-compat-3.29 0 3.29.6-r1
Chainguard calico-cni-compat-fips-3.29 0 3.29.6-r1
Chainguard calico-cni-fips-3.29 0 3.29.6-r1
Chainguard calico-fips-3.29 0 3.29.6-r1
Chainguard calico-key-cert-provisioner-3.29 0 3.29.6-r1
Chainguard calico-key-cert-provisioner-fips-3.29 0 3.29.6-r1
Chainguard calico-kube-controllers-3.29 0 3.29.6-r1
Chainguard calico-kube-controllers-fips-3.29 0 3.29.6-r1
Chainguard calico-pod2daemon-3.29 0 3.29.6-r1
Chainguard calico-pod2daemon-fips-3.29 0 3.29.6-r1
Chainguard calico-pod2daemon-flexvol-compat-3.29 0 3.29.6-r1
Chainguard calico-typha-client-3.29 0 3.29.6-r1
Chainguard calico-typha-client-fips-3.29 0 3.29.6-r1
Chainguard calico-typhad-3.29 0 3.29.6-r1
Chainguard calico-typhad-fips-3.29 0 3.29.6-r1
Chainguard calicoctl-3.29 0 3.29.6-r1
Chainguard calicoctl-fips-3.29 0 3.29.6-r1
Chainguard cephcsi 0 3.15.0-r2
Chainguard cephcsi-compat 0 3.15.0-r2
Chainguard cephcsi-fips 0 3.15.0-r2
Chainguard cluster-autoscaler-1.31 0 1.31.3-r3
Chainguard cluster-autoscaler-1.31-compat 0 1.31.3-r3
Chainguard cluster-autoscaler-fips-1.31 0 1.31.3-r4
Chainguard cluster-autoscaler-fips-1.31-compat 0 1.31.3-r4
Chainguard cluster-autoscaler-fips-1.33 0 1.33.0-r4
Chainguard cluster-autoscaler-fips-1.33-compat 0 1.33.0-r4
Chainguard docker-machine-driver-harvester 0 1.0.3-r3
Chainguard eks-distro-1.29 0 1.29.53-r1
Chainguard eks-distro-1.30 0 1.30.46-r1
Chainguard eks-distro-1.31 0 1.31.35-r1
Chainguard eks-distro-1.32 0 1.32.28-r1
Chainguard eks-distro-coredns-1.29 0 1.29.53-r1
Chainguard eks-distro-coredns-1.30 0 1.30.46-r1
Chainguard eks-distro-coredns-1.31 0 1.31.35-r1
Chainguard eks-distro-coredns-1.32 0 1.32.28-r1
Chainguard eks-distro-coredns-fips-1.29 0 1.29.53-r1
Chainguard eks-distro-coredns-fips-1.30 0 1.30.46-r1
Chainguard eks-distro-coredns-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-coredns-fips-1.32 0 1.32.28-r1
Chainguard eks-distro-fips-1.29 0 1.29.53-r1
Chainguard eks-distro-fips-1.30 0 1.30.46-r1
Chainguard eks-distro-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-fips-1.32 0 1.32.28-r1
Chainguard eks-distro-kube-apiserver-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-apiserver-1.32 0 1.32.28-r1
Chainguard eks-distro-kube-apiserver-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-apiserver-fips-1.32 0 1.32.28-r1
Chainguard eks-distro-kube-controller-manager-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-controller-manager-1.32 0 1.32.28-r1
Chainguard eks-distro-kube-controller-manager-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-controller-manager-fips-1.32 0 1.32.28-r0
Chainguard eks-distro-kube-proxy-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-proxy-1.32 0 1.32.28-r1
Chainguard eks-distro-kube-proxy-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-proxy-fips-1.32 0 1.32.28-r0
Chainguard eks-distro-kube-scheduler-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-scheduler-1.32 0 1.32.28-r1
Chainguard eks-distro-kube-scheduler-fips-1.31 0 1.31.35-r1
Chainguard eks-distro-kube-scheduler-fips-1.32 0 1.32.28-r1
Chainguard eks-distro-kubernetes-pause-1.29 0 1.29.53-r1
Chainguard eks-distro-kubernetes-pause-1.30 0 1.30.46-r0
Chainguard eks-distro-kubernetes-pause-1.31 0 1.31.35-r1
Chainguard eks-distro-kubernetes-pause-1.32 0 1.32.28-r1
Chainguard emissary 0 3.10.0-r9
Chainguard emissary-apiext 0 3.10.0-r9
Chainguard emissary-oci-entrypoint 0 3.10.0-r9
Chainguard ip-masq-agent 0 2.12.0-r12
Chainguard k8ssandra-client 0 0.8.2-r2
Chainguard k8ssandra-client-compat 0 0.8.2-r2
Chainguard k8ssandra-client-fips 0 0.8.2-r2
Chainguard kapp 0 0.64.2-r3
Chainguard kapp-fips 0 0.64.2-r5
Chainguard kube-apiserver-1.30-default 0 1.30.14-r8
Chainguard kube-apiserver-1.30-default-compat 0 1.30.14-r8
Chainguard kube-apiserver-1.32 0 1.32.11-r0
Chainguard kube-apiserver-1.32-default 0 1.32.11-r0
Chainguard kube-apiserver-1.32-default-compat 0 1.32.11-r0
Chainguard kube-apiserver-fips-1.30-default 0 1.30.14-r8
Chainguard kube-apiserver-fips-1.30-default-compat 0 1.30.14-r7
Chainguard kube-controller-manager-1.30-default 0 1.30.14-r8
Chainguard kube-controller-manager-1.30-default-compat 0 1.30.14-r8
Chainguard kube-controller-manager-1.32 0 1.32.11-r0
Chainguard kube-controller-manager-1.32-default 0 1.32.11-r0
Chainguard kube-controller-manager-1.32-default-compat 0 1.32.11-r0
Chainguard kube-controller-manager-fips-1.30-default 0 1.30.14-r8
Chainguard kube-controller-manager-fips-1.30-default-compat 0 1.30.14-r7
Chainguard kube-proxy-1.30-default 0 1.30.14-r8
Chainguard kube-proxy-1.30-default-compat 0 1.30.14-r8
Chainguard kube-proxy-1.32 0 1.32.11-r0
Chainguard kube-proxy-1.32-default 0 1.32.11-r0
Chainguard kube-proxy-1.32-default-compat 0 1.32.11-r0
Chainguard kube-proxy-fips-1.30-default 0 1.30.14-r8
Chainguard kube-proxy-fips-1.30-default-compat 0 1.30.14-r7
Chainguard kube-scheduler-1.30-default 0 1.30.14-r8
Chainguard kube-scheduler-1.30-default-compat 0 1.30.14-r8
Chainguard kube-scheduler-1.32 0 1.32.11-r0
Chainguard kube-scheduler-1.32-default 0 1.32.11-r0
Chainguard kube-scheduler-1.32-default-compat 0 1.32.11-r0
Chainguard kube-scheduler-fips-1.30-default 0 1.30.14-r7
Chainguard kube-scheduler-fips-1.30-default-compat 0 1.30.14-r7
Chainguard kubeadm-1.30-default 0 1.30.14-r8
Chainguard kubeadm-1.30-default-compat 0 1.30.14-r8
Chainguard kubeadm-1.32 0 1.32.11-r0
Chainguard kubeadm-1.32-default 0 1.32.11-r0
Chainguard kubeadm-1.32-default-compat 0 1.32.11-r0
Chainguard kubeadm-fips-1.30-default 0 1.30.14-r7
Chainguard kubeadm-fips-1.30-default-compat 0 1.30.14-r7
Chainguard kubectl-1.30-default 0 1.30.14-r8
Chainguard kubectl-1.30-default-compat 0 1.30.14-r8
Chainguard kubectl-1.30-iamguarded-compat 0 1.30.14-r8
Chainguard kubectl-1.32 0 1.32.11-r0
Chainguard kubectl-1.32-bitnami-compat 0 1.32.11-r0
Chainguard kubectl-1.32-default 0 1.32.11-r0
Chainguard kubectl-1.32-default-compat 0 1.32.11-r0
Chainguard kubectl-1.32-iamguarded-compat 0 1.32.11-r0
Chainguard kubectl-argo-rollouts 0 1.9.0-r0
Chainguard kubectl-argo-rollouts-fips 0 1.9.0-r0
Chainguard kubectl-bash-completion-1.30 0 1.30.14-r8
Chainguard kubectl-bash-completion-1.32 0 1.32.11-r0
Chainguard kubectl-bash-completion-fips-1.30 0 1.30.14-r7
Chainguard kubectl-fips-1.30-default 0 1.30.14-r7
Chainguard kubectl-fips-1.30-default-compat 0 1.30.14-r7
Chainguard kubelet-1.30-default 0 1.30.14-r8
Chainguard kubelet-1.30-default-compat 0 1.30.14-r8
Chainguard kubelet-1.32 0 1.32.11-r0
Chainguard kubelet-1.32-default 0 1.32.11-r0
Chainguard kubelet-1.32-default-compat 0 1.32.11-r0
Chainguard kubelet-fips-1.30-default 0 1.30.14-r7
Chainguard kubelet-fips-1.30-default-compat 0 1.30.14-r7
Chainguard kubernetes-1.30-default 0 1.30.14-r8

Related vulnerabilities