CVE-2025-5187: Kubernetes Nodes can delete themselves by adding an OwnerReference

August 27, 2025

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

References

github.com/advisories/GHSA-4x4m-3c2p-qppc
github.com/kubernetes/kubernetes
github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0f
github.com/kubernetes/kubernetes/issues/133471
groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE
nvd.nist.gov/vuln/detail/CVE-2025-5187

Code Behaviors & Features

Detect and mitigate CVE-2025-5187 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →