Database/Container, Kubernetes & orchestration
Kubernetes (kube-apiserver): A node can delete itself, and cascade-delete other objects, by adding an OwnerReference
CVSS 6.7CVE-2025-5187Container, Kubernetes & orchestrationcurated
Impact
A node can delete itself, and cascade-delete other objects, by adding an OwnerReference
Who can reach it
A compromised node / kubelet credential
What to do
Rolling control-plane upgrade; tighten the NodeRestriction admission plugin
References
Related entries
- Kubernetes (kube-apiserver): Node address not verified when proxyingCVE-2022-3294 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): YAML parsing CPU exhaustion in the apiserverCVE-2019-11254 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Node updates bypass a validating admission webhook, defeating node-level policyCVE-2021-25735 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Users authorized to list/watch one namespaced CR type can read other CR types in the sameCVE-2022-3162 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Ephemeral containers bypass the ImagePolicyWebhook, so unapproved images runCVE-2023-2727 · Kubernetes (kube-apiserver)Medium
- Kubernetes (kube-apiserver): Ephemeral containers bypass the ServiceAccount mountable-secrets policyCVE-2023-2728 · Kubernetes (kube-apiserver)Medium
This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.