Kubernetes Nodes can delete themselves by adding an OwnerReference

🗓️ 27 Aug 2025 18:31:55Reported by GitHub Advisory DatabaseType

Kubernetes NodeRestriction lets a node delete itself by patching an OwnerReference; if the resource is missing, the node is deleted.

Reporter	Title	Published	Views	Family All 143
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2025-5187)	29 Sep 202511:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	10 Nov 202508:26	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to object abuse due to Kubernetes (CVE-2025-5187)	28 Nov 202519:09	–	ibm
IBM Security Bulletins	Security Bulletin: ELM on Hybrid Cloud vulnerabilities addressed in 1.3.0	9 Mar 202613:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses k8s.io/kubernetes v1.33.1 which is vulnerable to CVE-2025-4563 and CVE-2025-5187	3 Feb 202610:39	–	ibm
Chainguard	CVE-2025-5187 vulnerabilities	29 Aug 202514:16	–	cgr
Circl	CVE-2025-5187	14 Aug 202501:07	–	circl
CNNVD	Kubernetes 安全漏洞	27 Aug 202500:00	–	cnnvd
CVE	CVE-2025-5187	27 Aug 202516:20	–	cve
Cvelist	CVE-2025-5187 Nodes can delete themselves by adding an OwnerReference	27 Aug 202516:20	–	cvelist

Vulners

Node

k8s.io kubernetesRange1.33.0-alpha.0–1.33.4go

k8s.io kubernetesRange1.32.0-alpha.0–1.32.7go

Source	Link
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-5187
github	www.github.com/kubernetes/kubernetes/issues/133471
groups	www.groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE
github	www.github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0f
github	www.github.com/advisories/GHSA-4x4m-3c2p-qppc

27 Aug 2025 19:20Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.16.7

EPSS0.00042

SSVC