Privilege Escalation

🗓️ 22 Sep 2025 07:24:52Reported by Veracode Vulnerability DatabaseType

Kubernetes privilege escalation via OwnerReference patch on Node risks cluster deletion.

Reporter	Title	Published	Views	Family All 143
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2025-5187)	29 Sep 202511:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	10 Nov 202508:26	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to object abuse due to Kubernetes (CVE-2025-5187)	28 Nov 202519:09	–	ibm
IBM Security Bulletins	Security Bulletin: ELM on Hybrid Cloud vulnerabilities addressed in 1.3.0	9 Mar 202613:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses k8s.io/kubernetes v1.33.1 which is vulnerable to CVE-2025-4563 and CVE-2025-5187	3 Feb 202610:39	–	ibm
Chainguard	CVE-2025-5187 vulnerabilities	29 Aug 202514:16	–	cgr
Circl	CVE-2025-5187	14 Aug 202501:07	–	circl
CNNVD	Kubernetes 安全漏洞	27 Aug 202500:00	–	cnnvd
CVE	CVE-2025-5187	27 Aug 202516:20	–	cve
Cvelist	CVE-2025-5187 Nodes can delete themselves by adding an OwnerReference	27 Aug 202516:20	–	cvelist

Vulners

Node

kubernetes k8s.io/kubernetesRangev1.32.0-alpha.0–1.32.0-alpha.0go

kubernetes k8s.io/kubernetesRangev1.33.0-alpha.0–1.33.0-alpha.0go

kubernetes k8s.io/kubernetesRange1.32.0-alpha.0–1.32.6go

kubernetes k8s.io/kubernetesRange1.33.0-alpha.0–1.33.2go

Source	Link
github	www.github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0f
groups	www.groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE
github	www.github.com/kubernetes/kubernetes/issues/133471
github	www.github.com/advisories/GHSA-4x4m-3c2p-qppc

03 Jun 2026 09:26Current

7High risk

Vulners AI Score7

CVSS 3.16.7

EPSS0.00042

SSVC