CVE-2025-5187

MediumCVSS 6.7/10Last modified Jun 17, 2026

Description

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

Metrics

CVSS 3.1 6.7/10CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Weakness enumeration

CWE-863

Affected software

No affected versions have been published.

Timeline

Published: Aug 27, 2025
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2025

CVE-2025-51908.8The Browse As plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 0.2. This is due to incorrect au CVE-2025-51917.3An Unquoted Search Path vulnerability has been identified in the utility for Moxa’s industrial computers (Windows). Due to the unquoted path CVE-2025-51927.5A missing authentication for critical function vulnerability in the client application of Soar Cloud HRD Human Resource Management System th CVE-2025-51944.8The WP Map Block WordPress plugin before 2.0.3 does not validate and escape some of its block options before outputting them back in a page CVE-2025-51954.3An issue has been discovered in GitLab CE/EE affecting all versions from 17.9 before 17.10.7, 17.11 before 17.11.3, and 18.0 before 18.0.1. CVE-2025-519516.1andisearch v0.5.249 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2025-519546.1playground.electronhub.ai v1.1.9 was discovered to contain a cross-site scripting (XSS) vulnerability.CVE-2025-519589.8aelsantex runcommand 2014-04-01, a plugin for DokuWiki, allows unauthenticated attackers to execute arbitrary system commands via lib/plugin CVE-2025-51966.6A vulnerability has been found in Wing FTP Server up to 7.4.3 and classified as critical. Affected by this vulnerability is an unknown funct CVE-2025-519626.1A HTML Injection vulnerability in the comment section of the project page in MicroStudio 24.01.29 allows remote attackers to inject arbitrar CVE-2025-519656.1OURPHP thru 8.6.1 is vulnerable to Cross-Site Scripting (XSS) via the "Name" field of the "Complete Profile" functionality under the "My Use CVE-2025-519666.1A cross-site scripting (XSS) vulnerability exists in the PDF preview functionality of uTools thru 7.1.1. When a user previews a specially cr