VDB

GHSA-4X4M-3C2P-QPPC

GHSA-4X4M-3C2P-QPPC PUBLISHED CVSS 6.699999809265137 MEDIUM

Kubernetes Nodes can delete themselves by adding an OwnerReference

Record from GitHub Advisory Database · Published August 27, 2025

k8s.io/kubernetes is fixed in 1.33.4, 1.32.8 and 1.31.12 (Go Modules)

Kubernetes Nodes can delete themselves by adding an OwnerReference

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
k8s.io/kubernetesGo Modules1.33.4, 1.32.8, 1.31.12
kubernetes-csi-driver-nfs-fipsChainguard4.11.0-r6
mesosphere-vsphere-csiWolfi3.5.0-r2
rancher-agent-2.12Wolfi2.12.1-r0
argo-cd-2.14Wolfi2.14.15-r4
k8ssandra-clientChainguard0.8.2-r2
azuredisk-csi-fips-1.31Chainguard1.31.11-r3
yunikorn-k8shim-fipsChainguard1.7.0-r4
emissaryChainguard3.10.0-r9
kubernetes-csi-driver-nfsWolfi4.11.0-r6
blob-csi-fips-1.24Chainguard1.24.11-r10
argo-cd-fips-2.13Chainguard2.13.9-r3

88 more packages have a fixed version. See every fix in Lookup.

Risk scores

CVSS 3.1
6.699999809265137
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L

Affected products

VendorProductVersions
chainguardkubernetes-csi-driver-nfs-fips0
wolfimesosphere-vsphere-csi0
wolfirancher-agent-2.120
wolfiargo-cd-2.140
chainguardk8ssandra-client0
chainguardazuredisk-csi-fips-1.310
chainguardyunikorn-k8shim-fips0
chainguardemissary0
wolfikubernetes-csi-driver-nfs0
chainguardblob-csi-fips-1.240
chainguardargo-cd-fips-2.130
chainguardrancher-webhook-0.60
chainguardazurefile-csi-fips-1.330
chainguardblob-csi-1.240
wolfiyunikorn-k8shim0
chainguardrancher-2.100
chainguardargo-cd-fips-3.00
chainguardkubernetes-csi-driver-nfs0
chainguardcephcsi-fips0
chainguardrancher-2.110

…and 81 more

Timeline

  • Aug 27, 2025 CVE Published
  • Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-4X4M-3C2P-QPPC
vulnetix vdb fixes GHSA-4X4M-3C2P-QPPC

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-4X4M-3C2P-QPPC/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›