StackRadar

CVE-2025-5187

Medium

Advisory

Published 27 Aug 2025In the index since 5 Sept 2026
Severity
Medium
worst across findings
CVSS
6.7
base score, highest
EPSS
0.005
44th percentile
CISA KEV
Not listed
no confirmed exploitation
Charts affected
235
of 17,781 indexed, latest versions
Container images
212
deployed by those charts
Fix available
1 of 1
affected package

Kubernetes Nodes can delete themselves by adding an OwnerReference

Carried by container images the latest versions of 235 of 17,781 indexed charts deploy, on 212 images.

Affected packageAffected versionsFixed inImages
k8s.io/kubernetesgolangv0.0.0-20240417172702-7c48c2bd72b9, v0.0.0-20240514104202-6911225c3f74, v0.0.0-20240611201126-f25b321b9ae4, v0.0.0-20240611201706-062798d53d83+107 more1.31.12, 1.32.8, 1.33.4212
OSV records
GHSA-4x4m-3c2p-qppc
Also known as
GO-2025-3915

Charts affected

235 by stars
ChartLatestAffected imagesRadar Score
gitlab-runner-operatorpnnl-miscscripts0.1.61 of 1See more

gitlab-runner-operator pnnl-miscscripts 0.1.6

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
pnnlmiscscripts/gitlab-runner-operator:0.1.3-1155131891741
k8s.io/kubernetes@v1.16.2
1.31.12

Open the chart page →

11,151
capsule-proxyprojectcapsuleOfficialVerified publisher0.14.11 of 2See more

capsule-proxy projectcapsule 0.14.1

1 of the 2 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
clastix/kubectl:v1.3122918a06c253
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.31.12

Open the chart page →

1,222
raven_profilerraven-profilerVerified publisher0.1.621 of 1See more

raven_profiler raven-profiler 0.1.62

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
public.ecr.aws/t0u0d5o5/ecr_authenticator:latest077e4e57e41c
k8s.io/kubernetes@v1.29.0
1.31.12

Open the chart page →

1,300
stackrox-chartredhat-cop0.0.101 of 1See more

stackrox-chart redhat-cop 0.0.10

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
k8s.io/kubernetes@v1.20.4
1.31.12

Open the chart page →

29,227
rke2-canal-1.19-1.20rke2-charts3.13.3-build20211022021 of 2See more

rke2-canal-1.19-1.20 rke2-charts 3.13.3-build2021102202

1 of the 2 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
rancher/hardened-calico:v3.13.3-build20210223c678c25d47c8
k8s.io/kubernetes@v1.16.2
1.31.12

Open the chart page →

5,942
krr-enforcerrobusta0.3.51 of 2See more

krr-enforcer robusta 0.3.5

1 of the 2 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
alpine/k8s:1.30.0bd01dae02676
k8s.io/kubernetes@v0.0.0-20240417172702-7c48c2bd72b9
1.31.12

Open the chart page →

4,038
ai-agentromholdings0.0.11 of 1See more

ai-agent romholdings 0.0.1

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/devtron/ai-agent:0.0.16545dac92173
k8s.io/kubernetes@v0.0.0-20241022202705-f0c1ea863533
1.31.12

Open the chart page →

9,607
argocdromholdings1.8.11 of 3See more

argocd romholdings 1.8.1

1 of the 3 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
argoproj/argocd:v1.8.1830e86cacefd
k8s.io/kubernetes@v1.19.2
1.31.12

Open the chart page →

10,466
argocd-certificate-refreshromholdings0.10.81 of 1See more

argocd-certificate-refresh romholdings 0.10.8

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/devtron/argocd-cert-refresh:v102b6db27eaf3d
k8s.io/kubernetes@v1.25.5
1.31.12

Open the chart page →

12,949
calicoromholdings0.1.11 of 4See more

calico romholdings 0.1.1

1 of the 4 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/devtron/calico-networking:node-v3.19.1bc4aa22272ef
k8s.io/kubernetes@v1.21.0-rc.0
1.31.12

Open the chart page →

10,071
devtron-enterpriseromholdings48.0.04 of 28See more

devtron-enterprise romholdings 48.0.0

4 of the 28 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/devtron/cost-sync:172ef62b-1159-39429edf210d763ca
k8s.io/kubernetes@v1.33.1
1.33.4
quay.io/devtron/inception:7beef376-948-313784c3b91bebd3d
k8s.io/kubernetes@v1.20.4
1.31.12
quay.io/devtron/kubectl:latest2ad610626658
k8s.io/kubernetes@v1.25.2
1.31.12
quay.io/devtron/silver-surfer:e3b9a2f6-1191-387899640e2dc4316
k8s.io/kubernetes@v1.29.6
1.31.12

Open the chart page →

68,240
devtron-in-clustercdromholdings0.10.21 of 2See more

devtron-in-clustercd romholdings 0.10.2

1 of the 2 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/devtron/kubewatch:49f906a5-419-14814eec0305b594c
k8s.io/kubernetes@v1.24.2
1.31.12

Open the chart page →

5,039
devtron-logs-dumpromholdings0.1.01 of 1See more

devtron-logs-dump romholdings 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/devtron/k8s-utils:807ca3c2-488-14005f296c2ec5db7
k8s.io/kubernetes@v1.27.2
1.31.12

Open the chart page →

4,928
devtron-operatorromholdings0.23.31 of 11See more

devtron-operator romholdings 0.23.3

1 of the 11 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/devtron/kubectl:latest2ad610626658
k8s.io/kubernetes@v1.25.2
1.31.12

Open the chart page →

32,902
orbitalryuunosukeds30.2.01 of 1See more

orbital ryuunosukeds3 0.2.0

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
ryuunosukeds3/orbital:latest0879f7261b10
k8s.io/kubernetes@v1.31.0
1.31.12

Open the chart page →

2,620
hermitcrabseal-ioVerified publisher0.1.41 of 2See more

hermitcrab seal-io 0.1.4

1 of the 2 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
sealio/terraform-deployer:v1.5.7-seal.1b0389d9848a5
k8s.io/kubernetes@v1.25.5
1.31.12

Open the chart page →

4,881
secret-managersecret-managerVerified publisher1.0.01 of 4See more

secret-manager secret-manager 1.0.0

1 of the 4 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
leonardomulticloud/webhook:v1.0.0d119918900e8
k8s.io/kubernetes@v0.0.0-20240911212207-948afe5ca072
1.31.12

Open the chart page →

5,497
loggensikalabs0.1.01 of 1See more

loggen sikalabs 0.1.0

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
sikalabs/slu:v0.72.07bd267f30247
k8s.io/kubernetes@v1.24.14
1.31.12

Open the chart page →

2,314
kyvernosoftonic3.5.21 of 7See more

kyverno softonic 3.5.2

1 of the 7 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.32.73c5268158974
k8s.io/kubernetes@v0.0.0-20250715180032-158eee9fac88
1.31.12

Open the chart page →

1,019
gloo-meshsolo-gloo-mesh1.1.21 of 1See more

gloo-mesh solo-gloo-mesh 1.1.2

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
gcr.io/gloo-mesh/gloo-mesh:1.1.2a4011eae6a0b
k8s.io/kubernetes@v1.13.0
1.31.12

Open the chart page →

3,257
spire-identity-exchangespiffeVerified publisher0.2.21 of 3See more

spire-identity-exchange spiffe 0.2.2

1 of the 3 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
registry.k8s.io/kubectl:v1.31.099b37df34bc4
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.31.12

Open the chart page →

1,427
ambassador-manifestssqream-chartsVerified publisher0.6.31 of 1See more

ambassador-manifests sqream-charts 0.6.3

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
datawire/aes:3.11.195ec30b3c732
k8s.io/kubernetes@v1.30.1
1.31.12

Open the chart page →

2,416
cost-analyzerstatcan1.82.21 of 9See more

cost-analyzer statcan 1.82.2

1 of the 9 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
gcr.io/kubecost1/server:prod-1.82.22b1a3d08caac
k8s.io/kubernetes@v1.14.1
1.31.12

Open the chart page →

16,506
nfs-provisionersupporttools0.11.01 of 1See more

nfs-provisioner supporttools 0.11.0

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
openebs/provisioner-nfs:0.11.04f41dd782761
k8s.io/kubernetes@v1.17.3
1.31.12

Open the chart page →

2,671
tfy-inferentia-operatortruefoundryVerified publisher0.2.81 of 3See more

tfy-inferentia-operator truefoundry 0.2.8

1 of the 3 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
public.ecr.aws/eks-distro/kubernetes/kube-scheduler:v1.29.14-eks-1-29-lateste7e1db003e6a
k8s.io/kubernetes@v0.0.0-20250108021927-cd1e1306b0ba
1.31.12

Open the chart page →

2,902
jupyterhubuninettsigma21.6.01 of 5See more

jupyterhub uninettsigma2 1.6.0

1 of the 5 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
bitnamilegacy/kubectl:1.301249fc292e84
k8s.io/kubernetes@v0.0.0-20241119172634-0c76c645d5a6
1.31.12

Open the chart page →

8,607
vineyard-operatorvineyardVerified publisher0.24.21 of 2See more

vineyard-operator vineyard 0.24.2

1 of the 2 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
vineyardcloudnative/vineyard-operator:latest9d419aa18faa
k8s.io/kubernetes@v1.19.3
1.31.12

Open the chart page →

4,525
azure-scheduledevents-managerwebdevopsVerified publisher1.0.171 of 1See more

azure-scheduledevents-manager webdevops 1.0.17

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
webdevops/azure-scheduledevents-manager:24.9.0-kubernetes7acd46a8a972
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.31.12

Open the chart page →

1,122
emissary-ingresswenerme8.12.21 of 2See more

emissary-ingress wenerme 8.12.2

1 of the 2 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
datawire/emissary:3.12.21f67a1292d2a
k8s.io/kubernetes@v1.30.3
1.31.12

Open the chart page →

10,843
longhornwenerme1.2.31 of 2See more

longhorn wenerme 1.2.3

1 of the 2 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
longhornio/longhorn-manager:v1.2.3dca34321452c
k8s.io/kubernetes@v1.18.19
1.31.12

Open the chart page →

15,230
nfs-subdir-external-provisionerwenerme4.0.181 of 1See more

nfs-subdir-external-provisioner wenerme 4.0.18

1 of the 1 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/nfs-subdir-external-provisioner:v4.0.263d5e04551ec
k8s.io/kubernetes@v1.18.0
1.31.12

Open the chart page →

2,743
ceph-csi-cephfswikimedia0.1.81 of 5See more

ceph-csi-cephfs wikimedia 0.1.8

1 of the 5 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
k8s.io/kubernetes@v1.24.4
1.31.12

Open the chart page →

10,285
ceph-csi-rbdwikimedia0.1.131 of 6See more

ceph-csi-rbd wikimedia 0.1.13

1 of the 6 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
quay.io/cephcsi/cephcsi:v3.7.2f7f8228f17cc
k8s.io/kubernetes@v1.24.4
1.31.12

Open the chart page →

11,784
csi-driver-host-pathwiremindVerified publisher0.1.11 of 8See more

csi-driver-host-path wiremind 0.1.1

1 of the 8 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
registry.k8s.io/sig-storage/hostpathplugin:v1.9.092257881c1d6
k8s.io/kubernetes@v1.20.0
1.31.12

Open the chart page →

12,606
xkopsxkops0.1.01 of 5See more

xkops xkops 0.1.0

1 of the 5 container images this version deploys carry CVE-2025-5187.

Container imageDigestPackageFixed in
murtazashah46/helmfile:latest4d11726cf803
k8s.io/kubernetes@v0.0.0-20241022202812-5864a4677267
1.31.12

Open the chart page →

13,677

Container images carrying it

212 by charts deploying them

A fixed version is listed for 1 of the 1 affected package.

Container imageDigestPackageFixed inUsed by
ghcr.io/keptn/scheduler:v0.8.20f7d277bb2b2
k8s.io/kubernetes@v1.25.13
1.31.12
1
ghcr.io/kluster-manager/cluster-proxy:v0.10.1a7fce69e171c
k8s.io/kubernetes@v0.0.0-20240611202059-39683505b630
1.31.12
1
ghcr.io/kluster-manager/multicluster-controlplane:latest6de40f528be9
k8s.io/kubernetes@v1.29.2
1.31.12
1
ghcr.io/kubiyabot/kubernetes:1.32.0b5ade0d9cc6b
k8s.io/kubernetes@v0.0.0-20241211175915-70d3cc986aa8
1.31.12
1
ghcr.io/kubiyabot/tool-manager:0.5.80cca6760763a
k8s.io/kubernetes@v1.29.0
1.31.12
1
ghcr.io/kvaps/kube-fencing-controller:v2.4.0313edfec2fca
k8s.io/kubernetes@v1.25.3
1.31.12
1
ghcr.io/kvaps/linstor-csi:v1.14.0087618d16b83
k8s.io/kubernetes@v1.14.10
1.31.12
1
ghcr.io/kvaps/linstor-stork:v1.14.05e409a6332b4
k8s.io/kubernetes@v1.20.4
1.31.12
1
ghcr.io/liangyuanpeng/replacer:v1.1.00b2a41c2a43e
k8s.io/kubernetes@v1.16.10
1.31.12
1
ghcr.io/loft-sh/devpod-pro:0.0.0-ci.4-do-not-use5dfa86b6451f
k8s.io/kubernetes@v1.29.2
1.31.12
1
ghcr.io/loft-sh/loft:0.0.0-ci.14b69bcdaa8492
k8s.io/kubernetes@v1.28.0
1.31.12
1
ghcr.io/loft-sh/vcluster-control-plane:0.0.0-ci.4-do-not-use45e744fc623f
k8s.io/kubernetes@v1.29.2
1.31.12
1
ghcr.io/mskazemi/kubeintellect:2.5.0b5d7681d1b9d
k8s.io/kubernetes@v0.0.0-20250422155613-59526cd48674
1.31.12
1
ghcr.io/nefelim4ag/k8s-ssh-bastion:0.5.04d337e14c80b
k8s.io/kubernetes@v0.0.0-20240611201706-062798d53d83
1.31.12
1
ghcr.io/oguzhan-yilmaz/argocd-backup-s3:latestb61c750ade19
k8s.io/kubernetes@v1.23.1
1.31.12
1
ghcr.io/oguzhan-yilmaz/kdiff-snapshots:0.0.55d7f93d2182fe
k8s.io/kubernetes@v1.33.3
1.33.4
1
ghcr.io/peak-scale/capsule-argo-addon:0.7.5087a80163971
k8s.io/kubernetes@v1.33.1
1.33.4
1
ghcr.io/spidernet-io/spiderpool/spiderpool-agent:v1.2.08bb9411e47e0
k8s.io/kubernetes@v1.29.0
1.31.12
1
ghcr.io/spidernet-io/spiderpool/spiderpool-controller:v1.2.042304e3ed36e
k8s.io/kubernetes@v1.29.0
1.31.12
1
ghcr.io/tjm/vault-gcp-secrets:v1.19.59f157fe035f1
k8s.io/kubernetes@v0.0.0-20240813072848-9edcffcde559
1.31.12
1
ghcr.io/turbot/guardrails-agent-kubernetes:0.3.09d01bf9c9224
k8s.io/kubernetes@v0.0.0-20241119134819-c83cbee114dd
1.31.12
1
mcr.microsoft.com/k8s/csi/azuredisk-csi:v1.1.1ec1803037ed9
k8s.io/kubernetes@v1.21.0-alpha.0.0.20201210005053-f58c4d8cd725
1.31.12
1
public.ecr.aws/eks-distro/kubernetes/kube-scheduler:v1.29.14-eks-1-29-lateste7e1db003e6a
k8s.io/kubernetes@v0.0.0-20250108021927-cd1e1306b0ba
1.31.12
1
public.ecr.aws/t0u0d5o5/ecr_authenticator:latest077e4e57e41c
k8s.io/kubernetes@v1.29.0
1.31.12
1
quay.io/aerokube/keygen:1.0.1578934444f04
k8s.io/kubernetes@v1.27.3
1.31.12
1
quay.io/argoproj/argocd:v2.4.115b6701d8fb31
k8s.io/kubernetes@v1.23.1
1.31.12
1
quay.io/argoproj/argocd:v3.0.395b5cf7ba6fe
k8s.io/kubernetes@v1.32.2
1.32.8
1
quay.io/argoproj/argocd:v3.1.1a36ab0c0860c
k8s.io/kubernetes@v1.33.1
1.33.4
1
quay.io/argoproj/argocd:v2.8.6acaf37352569
k8s.io/kubernetes@v1.24.2
1.31.12
1
quay.io/argoprojlabs/argocd-rbac-operator:v0.2.451dded00137a
k8s.io/kubernetes@v1.32.6
1.32.8
1
quay.io/bentoml/yatai:0.4.614b482c1f1b8
k8s.io/kubernetes@v1.13.4
1.31.12
1
quay.io/bentoml/yatai:1.1.13a5dc9d91de0d
k8s.io/kubernetes@v1.25.9
1.31.12
1
quay.io/ddn/exascaler-csi-file-driver:v2.2.6fe2e2e5a2751
k8s.io/kubernetes@v1.14.1
1.31.12
1
quay.io/gkarthics/apid-helper:v0.2.3d7d93debf1f4
k8s.io/kubernetes@v1.24.2
1.31.12
1
quay.io/icdh/core-dump-handler:v9.0.0cc79b9e2a1c8
k8s.io/kubernetes@v1.22.0
1.31.12
1
quay.io/konveyor/move2kube-ui:latestec6ab507c5da
k8s.io/kubernetes@v1.24.2
1.31.12
1
quay.io/kubermatic/kubermatic:v2.24.5ebba936046ab
k8s.io/kubernetes@v1.27.4
1.31.12
1
quay.io/ongres/kubectl:v1.25.16-build-6.5304dada9e4503
k8s.io/kubernetes@v1.25.16
1.31.12
1
quay.io/open-cluster-management/cluster-proxy:v0.12.035f9c3ad644a
k8s.io/kubernetes@v0.0.0-20240611202059-39683505b630
1.31.12
1
quay.io/opsmxpublic/create-secret:v4.0.4defc3263e0e9
k8s.io/kubernetes@v1.25.9
1.31.12
1
quay.io/rht-labs/stack-do500:3.0.86ba82beff18e
k8s.io/kubernetes@v1.20.4
1.31.12
1
registry.k8s.io/autoscaling/cluster-autoscaler:v1.33.06ef10d108e0e
k8s.io/kubernetes@v1.33.1
1.33.4
1
registry.k8s.io/csi-vsphere/driver:v3.5.04bb8350a5a62
k8s.io/kubernetes@v1.33.0
1.33.4
1
registry.k8s.io/csi-vsphere/driver:v3.4.0f5349a8ae3f3
k8s.io/kubernetes@v1.31.2
1.31.12
1
registry.k8s.io/csi-vsphere/syncer:v3.4.0179ebf195595
k8s.io/kubernetes@v1.31.2
1.31.12
1
registry.k8s.io/csi-vsphere/syncer:v3.5.0bb88468fff2a
k8s.io/kubernetes@v1.33.0
1.33.4
1
registry.k8s.io/dns/k8s-dns-node-cache:1.23.081a13703d6b8
k8s.io/kubernetes@v1.26.10
1.31.12
1
registry.k8s.io/dns/k8s-dns-node-cache:1.23.1e3dccb1a21d1
k8s.io/kubernetes@v1.26.10
1.31.12
1
registry.k8s.io/kube-apiserver:v1.25.0f6902791fb9a
k8s.io/kubernetes@v1.25.0
1.31.12
1
registry.k8s.io/kube-controller-manager:v1.25.066ce7d460e53
k8s.io/kubernetes@v1.25.0
1.31.12
1

syft 1.42.1 · advisories as of 14 Sept 2026

Corrections: contact@stackradar.io

Catalogue: Artifact Hub · Advisories: OSV · Exploitation: FIRST EPSS, CISA KEV.