Is CVE-2025-5187 in the CISA KEV catalog?

No. CVE-2025-5187 is not currently on the CISA Known Exploited Vulnerabilities list.

What is the CVSS severity of CVE-2025-5187?

CVE-2025-5187 has a CVSS v3 base score of 6.7 (MEDIUM).

What is the EPSS score for CVE-2025-5187?

CVE-2025-5187 has an EPSS score of 0.43% (35th percentile), estimating the probability of exploitation in the next 30 days.

How do I fix CVE-2025-5187?

Upgrade kubernetes on debian 11 to 1.20.5+really1.20.2-1 or later. Fixes are available for 309 affected products.

CVE & CISA-KEV Catalog

CVE-2025-5187

MEDIUM

6.7

CVSS v3

NVD

Description

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

CWE-863Incorrect Authorization

How to fix

Remediation Available

kubernetesDebian

Fixed in:1.20.5+really1.20.2-1CVE-2025-5187

registry.redhat.io/openshift4/aws-karpenter-providerRocky

Fixed in:aws-rhel9@sha256:377d1ac2d4bb570b2a049d564f8e334da2dde1a47e31ac5d210bf701b5d5bf54_ppc64leRHBA-2025:15694

Fixed in:aws-rhel9@sha256:004ebd00806f07c72b9c3408187fd1227ddf280d2113c4c73404967c8ef644b6_arm64RHBA-2025:15694

Fixed in:aws-rhel9@sha256:e712d207542b63283d7f535e664938bd5bee2bd95bd204d43ac9c824a305a32f_amd64RHBA-2025:15694

Fixed in:aws-rhel9@sha256:6e2f0c11f21d97f95d5799bee387d435b25efe47ca3e694d4b233bb714027eaf_s390xRHBA-2025:15694

registry.redhat.io/openshift4/aws-karpenter-providerRed Hat / RHEL

Fixed in:aws-rhel9@sha256:6e2f0c11f21d97f95d5799bee387d435b25efe47ca3e694d4b233bb714027eaf_s390xRHBA-2025:15694

Fixed in:aws-rhel9@sha256:377d1ac2d4bb570b2a049d564f8e334da2dde1a47e31ac5d210bf701b5d5bf54_ppc64leRHBA-2025:15694

Fixed in:aws-rhel9@sha256:004ebd00806f07c72b9c3408187fd1227ddf280d2113c4c73404967c8ef644b6_arm64RHBA-2025:15694

Fixed in:aws-rhel9@sha256:e712d207542b63283d7f535e664938bd5bee2bd95bd204d43ac9c824a305a32f_amd64RHBA-2025:15694

registry.redhat.io/openshift4/aws-kms-encryptionRocky

Fixed in:provider-rhel9@sha256:7ad7c7f55a4275865903041d614f3fd967ff84f0c9c065e561493f01e2ed7f06_amd64RHBA-2025:15714

Fixed in:provider-rhel9@sha256:3d49af13876ecc8aff4fc54d6e8f9ae59da311ea6d9846f6c4f36b1ad9f69415_arm64RHBA-2025:15714

Fixed in:provider-rhel9@sha256:ae93cd96c35064801db0a3a6e36d65dfb7ad96a60df68b3fcf9149856bb91382_s390xRHBA-2025:15714

Fixed in:provider-rhel9@sha256:9fa130a69c08a16d8bdd49ac69bd1933fd782cb865a5b5aee25e09e62953404d_ppc64leRHBA-2025:15714

Fixed in:provider-rhel9@sha256:ec49dc91f8d384ffd39c1d6745bf62f5d2dcbc9c53ec32518fb27cce934fa9ba_amd64RHBA-2025:15694

Fixed in:provider-rhel9@sha256:662c43244ac6d0acbdd3f7b6289400163fb5d893c92d39aa3eabc36c350f01b0_arm64RHBA-2025:15694

Fixed in:provider-rhel9@sha256:b86e13901755ac0bf975e1a4f948a9ba6cf2318281597d570ba67ccd32354eab_ppc64leRHBA-2025:15694

Fixed in:provider-rhel9@sha256:5a553fbd361daf9ca8f7f5a411e4ef5d0e2bc87b1d2979f349075e0aa75e879f_s390xRHBA-2025:15694

registry.redhat.io/openshift4/aws-kms-encryptionRed Hat / RHEL