Description
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | v1.31.0 – ≤ v1.31.11, v1.32.0 – ≤ v1.32.7, v1.33.0 – ≤ v1.33.3 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | govulncheck-vulndb | 0.0.20250918T182144-150000.1.107.1 | SUSE-SU-2025:03289-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250918T182144-1.1 | openSUSE-SU-2025:15566-1 |
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20250918T182144-150000.1.107.1 | SUSE-SU-2025:03289-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-rollouts +1 | 1.9.0-r0 | — |
| Wolfi rolling | docker-machine-driver-harvester | 1.0.6-r4 | — |
| Wolfi rolling | emissary +6 | 3.10.0-r9 | — |
| Wolfi rolling | ip-masq-agent | 2.12.0-r12 | — |
| Wolfi rolling | k8ssandra-client +1 | 0.8.2-r2 | — |
| Wolfi rolling | kapp | 0.64.2-r3 | — |
| Wolfi rolling | kubectl-1.30 | No fix yet | — |
| Wolfi rolling | kubectl-1.32 +1 | 1.32.11-r0 | — |
| Wolfi rolling | kubernetes-csi-driver-hostpath | 1.17.0-r4 | — |
| Wolfi rolling | kubernetes-csi-driver-nfs +1 | 4.11.0-r6 | — |
| Wolfi rolling | kubernetes-dns-node-cache | 1.26.7-r0 | — |
| Wolfi rolling | local-static-provisioner +1 | 2.9.0-r0 | — |
| Wolfi rolling | local-volume-node-cleanup-compat | 2.9.0-r4 | — |
| Wolfi rolling | mesosphere-vsphere-csi +2 | 3.5.0-r2 | — |
| Wolfi rolling | nodetaint | 0.0.4-r36 | — |
| Wolfi rolling | rancher-system-agent | 0.3.13-r2 | — |
| Wolfi rolling | vcluster +2 | 0.27.0-r2 | — |
| Wolfi rolling | yunikorn-k8shim | 1.7.0-r3 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | < 1.31.12 | 1.31.12 | GHSA-4x4m-3c2p-qppc |
| Go | k8s.io/kubernetes | >= 1.32.0-alpha.0, < 1.32.8 | 1.32.8 | GHSA-4x4m-3c2p-qppc |
| Go | k8s.io/kubernetes | >= 1.33.0-alpha.0, < 1.33.4 | 1.33.4 | GHSA-4x4m-3c2p-qppc |
| Go | k8s.io/kubernetes | < 1.31.12 · >= 1.32.0-alpha.0, < 1.32.8 · >= 1.33.0-alpha.0, < 1.33.4 | 1.31.12, 1.32.8, 1.33.4 | GO-2025-3915 |
Advisories 4
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- openSUSE-SU-2025:15566-1 govulncheck-vulndb-0.0.20250918T182144-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:03289-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1831 Kubernetes: Schwachstelle ermöglicht Manipulation von Dateien BSI CERT-Bund (WID) · Aug 27, 2025