Vulnerability Report: GO-2025-3915
- CVE-2025-5187, GHSA-4x4m-3c2p-qppc
- Affects: k8s.io/kubernetes
- Published: Sep 18, 2025
Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes
For detailed information about this vulnerability, visit https://github.com/advisories/GHSA-4x4m-3c2p-qppc.
Affected Modules
-
PathGo Versions
-
before v1.31.12, from v1.32.0-alpha.0 before v1.32.8, from v1.33.0-alpha.0 before v1.33.4
Aliases
References
- https://github.com/advisories/GHSA-4x4m-3c2p-qppc
- https://github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0f
- https://github.com/kubernetes/kubernetes/issues/133471
- https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE
- https://vuln.go.dev/ID/GO-2025-3915.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.