CVE-2025-5187: Nodes can delete themselves by adding an OwnerReference
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.33.4 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.32.8 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.31.12
Event History
Frequently Asked Questions
What is the severity of CVE-2025-5187?
The severity of CVE-2025-5187 is considered high due to the potential for unauthorized deletion of critical node objects in Kubernetes.
How do I fix CVE-2025-5187?
To fix CVE-2025-5187, ensure that your Kubernetes cluster is updated to a version that includes the patch for this vulnerability.
Who is affected by CVE-2025-5187?
CVE-2025-5187 affects Kubernetes clusters where node users have the capability to modify their node object permissions.
What potential impact does CVE-2025-5187 have?
The potential impact of CVE-2025-5187 includes unauthorized access to resources and disruption of services due to the deletion of node objects.
What is NodeRestriction admission controller in Kubernetes with respect to CVE-2025-5187?
The NodeRestriction admission controller in Kubernetes is designed to limit the permissions of node users, and CVE-2025-5187 exploits a flaw in its implementation.