A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

An update of the kubernetes package has been released.

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-016823 advisory.

    A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users     can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-     scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node     object will be deleted via garbage collection.

Tenable has extracted the preceding description block directly from the Unity Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users
    can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-
    scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node
    object will be deleted via garbage collection. (CVE-2025-5187)

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-409ed32016 advisory.

    - Update to release v1.33.4
    - Resolves: rhbz#2388412
    - Fixes CVE-2025-5187: Nodes can delete themselves by adding an       OwnerReference
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-d78e6ddfe3 advisory.

    - Update to release v1.31.12
    - Resolves: rhbz#2388412
    - Resolves: CVE-2025-5187: Nodes can delete themselves by adding an       OwnerReference
    - Upstream fix

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-51e8d5ec56 advisory.

    - Update to release v1.33.4
    - Resolves: rhbz#2388412
    - Fixes CVE-2025-5187: Nodes can delete themselves by adding an       OwnerReference
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 42 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-9b52dfdae9 advisory.

    - Update to release v1.32.7
    - Resolves: rhbz#2388412
    - Resolves: CVE-2025-5187: Nodes can delete themselves by adding an       OwnerReference
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-8f9b0ca4c7 advisory.

    - Update to release v1.32.7
    - Resolves: rhbz#2388412
    - Resolves: CVE-2025-5187: Nodes can delete themselves by adding an       OwnerReference
    - Upstream fixes

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Fedora 41 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2025-a1ec5a674c advisory.

    - Update to release v1.31.12
    - Resolves: rhbz#2388412
    - Resolves: CVE-2025-5187: Nodes can delete themselves by adding an       OwnerReference
    - Upstream fix

Tenable has extracted the preceding description block directly from the Fedora security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
333757	Photon OS 5.0: Kubernetes PHSA-2025-5.0-91-0698	Nessus	PhotonOS Local Security Checks	Local	medium
313568	Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-016823)	Nessus	Unity Linux Local Security Checks	Local	medium
278947	Photon OS 5.0: Kubernetes PHSA-2025-5.0-0698	Nessus	PhotonOS Local Security Checks	Local	medium
435132	SCA: security update for k8s.io/kubernetes (GHSA-4x4m-3c2p-qppc)	Tenable Cloud Security	SCA Checks	Local	medium
435132	SCA: security update for k8s.io/kubernetes (GHSA-4x4m-3c2p-qppc)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
253676	Fedora 42 : kubernetes1.33 (2025-409ed32016)	Nessus	Fedora Local Security Checks	Local	critical
253675	Fedora 42 : kubernetes1.31 (2025-d78e6ddfe3)	Nessus	Fedora Local Security Checks	Local	critical
253674	Fedora 41 : kubernetes1.33 (2025-51e8d5ec56)	Nessus	Fedora Local Security Checks	Local	critical
253673	Fedora 42 : kubernetes1.32 (2025-9b52dfdae9)	Nessus	Fedora Local Security Checks	Local	critical
253671	Fedora 41 : kubernetes1.32 (2025-8f9b0ca4c7)	Nessus	Fedora Local Security Checks	Local	critical
253669	Fedora 41 : kubernetes1.31 (2025-a1ec5a674c)	Nessus	Fedora Local Security Checks	Local	critical

Detections

Analytics

CVE-2025-5187

medium

Tenable Plugins

medium

medium

medium

medium

medium

critical

critical

critical

critical

critical

critical