Incorrect authorization in apiserver - CVE-2025-5187

Vulnerability identifier: #VU115217

CSH Severity: Low

CVSS v4: 8.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N]

CVE-ID: CVE-2025-5187

CWE-ID: CWE-863

Exploitation vector: Local access

Exploit availability: No public exploit available

The vulnerability allows a node user to escalate privileges on the system.

The vulnerability exists due to incorrect authorization in the NodeRestriction admission controller. A node user can delete and then recreate its node object with modified taints or labels.

apiserver
Engineering Lifecycle Management
Astronomer with IBM
Netcool Operations Insight
IBM Maximo Application Suite
openEuler
Anolis OS
Fedora
kubernetes-kubeadm
kubernetes
kubernetes-client
kubernetes-help
kubernetes-kubelet
kubernetes-node
kubernetes-master
kubernetes1.31
kubernetes1.32
kubernetes1.33

Install updates from vendor's website.

apiserver - addressed in versions 1.31.12, 1.32.8, 1.33.4
Engineering Lifecycle Management - update to 1.3.0
Astronomer with IBM - update to 1.1.0
Netcool Operations Insight - update to 1.6.15
IBM Maximo Application Suite - addressed in versions 8.10.33, 8.11.30, 9.0.19, 9.1.8
kubernetes-kubeadm - addressed in versions 1.20.2-27, 1.29.1-13
kubernetes - addressed in versions 1.20.2-27, 1.29.1-13
kubernetes-client - addressed in versions 1.20.2-27, 1.29.1-13
kubernetes-help - addressed in versions 1.20.2-27, 1.29.1-13
kubernetes-kubelet - addressed in versions 1.20.2-27, 1.29.1-13
kubernetes-node - addressed in versions 1.20.2-27, 1.29.1-13
kubernetes-master - addressed in versions 1.20.2-27, 1.29.1-13
kubernetes - update to 1.29.15-2
kubernetes-client - update to 1.29.15-2
kubernetes-kubeadm - update to 1.29.15-2
kubernetes-master - update to 1.29.15-2
kubernetes-node - update to 1.29.15-2
kubernetes1.31 - addressed in versions 1.31.12-1.fc41, 1.31.12-1.fc42
kubernetes1.32 - addressed in versions 1.32.8-1.fc41, 1.32.8-1.fc42
kubernetes1.33 - addressed in versions 1.33.4-1.fc41, 1.33.4-1.fc42

• https://github.com/kubernetes/kubernetes/issues/133471
• https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE

• Privilege escalation in Kubernete apiserver
• Fedora 42 update for kubernetes1.33
• Fedora 41 update for kubernetes1.33
• Fedora 42 update for kubernetes1.32
• Fedora 42 update for kubernetes1.31
• Fedora 41 update for kubernetes1.31
• Fedora 41 update for kubernetes1.32
• openEuler 22.03 LTS SP3 update for kubernetes
• openEuler 20.03 LTS SP4 update for kubernetes
• openEuler 24.03 LTS SP2 update for kubernetes
• openEuler 24.03 LTS SP1 update for kubernetes
• openEuler 24.03 LTS update for kubernetes
• openEuler 22.03 LTS SP4 update for kubernetes
• Anolis OS update for kubernetes
• Multiple vulnerabilities in Netcool Operations Insight
• Astronomer with IBM update for Kubernetes
• Multiple vulnerabilities in IBM Maximo Application Suite
• Multiple vulnerabilities in IBM Engineering Lifecycle Management on Hybrid Cloud