More information about this security flaw is available in the following bug: https://bugzilla.redhat.com/show_bug.cgi?id=2348366 Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
According to this Kubernetes pull request (https://github.com/kubernetes/kubernetes/pull/130474) CVE-2025-22868 does not affect Kubernetes as the problem is specifically in the golang.org/x/oauth2/jws package. This package is not part of Kubernetes. I can backport the oauth2 package if needed to version 0.27.