CVE-2025-5187 — Nodes can delete themselves by adding an OwnerReference
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with…
Published: 2025-08-27 · CVSS: 6.7 · CVSS 3.1
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7