CLEANSTART-2026-RQ66683: vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to ...

Q: What access would an attacker need to exploit this issue?

The attacker needs high privileges and must be able to act as a node user for the affected node. The attack is network-reachable, has low attack complexity, and does not require user interaction.

Q: What is the expected security impact if exploitation succeeds?

The vulnerability can result in high confidentiality and integrity impact and low availability impact. The CVSS vector indicates that the security scope is unchanged.

Published Nov 5, 2026

Updated

Security vulnerability affects the nfs-subdir-external-provisioner package. A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource.

Affected Software

1 affected componentFixes available

cleanstart/nfs-subdir-external-provisioner<4.0.2-r4

4.0.2-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/nfs-subdir-external-provisioner to a version that resolves this vulnerability.
Fixed in 4.0.2-r4

Event History

Nov 5, 2026

Advisory Published

via OSV·08:10 AM

Data Sourced

via OSV·08:10 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-5187

Frequently Asked Questions

What access would an attacker need to exploit this issue?

The attacker needs high privileges and must be able to act as a node user for the affected node. The attack is network-reachable, has low attack complexity, and does not require user interaction.

What is the expected security impact if exploitation succeeds?

The vulnerability can result in high confidentiality and integrity impact and low availability impact. The CVSS vector indicates that the security scope is unchanged.

CLEANSTART-2026-RQ66683: vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to ...

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access would an attacker need to exploit this issue?

What is the expected security impact if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

What access would an attacker need to exploit this issue?

What is the expected security impact if exploitation succeeds?