GHSA-4x4m-3c2p-qppc

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

Database specific

{
    "severity": "MODERATE",
    "github_reviewed_at": "2025-08-27T19:20:29Z",
    "cwe_ids": [
        "CWE-863"
    ],
    "nvd_published_at": "2025-08-27T17:15:48Z",
    "github_reviewed": true
}

References

Affected packages

Go / k8s.io/kubernetes

Package

Name: k8s.io/kubernetes; View open source insights on deps.dev
Purl: pkg:golang/k8s.io/kubernetes

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

1.31.12

Go / k8s.io/kubernetes

Package

Name: k8s.io/kubernetes; View open source insights on deps.dev
Purl: pkg:golang/k8s.io/kubernetes

Affected ranges

Type: SEMVER
Events: Introduced

1.32.0-alpha.0

Fixed

1.32.8

Database specific

{
    "last_known_affected_version_range": "< 1.32.7"
}