CVE-2025-5187: Nodes can delete themselves by adding an OwnerReference

Severity: medium (CVSS 6.7 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.6% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2025-08-27 · updated 2026-06-17
Weakness: CWE-863

Description

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

Affected products

Kubernetes: from v1.31.0 through v1.31.11; from v1.32.0 through v1.32.7; from v1.33.0 through v1.33.3

References

https://github.com/kubernetes/kubernetes/issues/133471
https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE

Get alerted when CVE-2025-5187 or the next vulnerability affects your stack