CVE-2025-5187
CVE-2025-5187 · Nodes can delete themselves by adding an OwnerReference
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
CVSS 6.7 · Medium · EPSS 0.6% · Fix available
- Published
- Updated
Stack: system · containers
Affected products and versions
kubernetes
- Versions
- ≥ v1.31.0, ≤ v1.31.11: Affected (custom)
- ≥ v1.32.0, ≤ v1.32.7: Affected (custom)
- ≥ v1.33.0, ≤ v1.33.3: Affected (custom)
No fix published
kubernetes Debian:12
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1
kubernetes Debian:13
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1
kubernetes Debian:14
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1