CLEANSTART-2026-RQ66683 vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to ...

🗓️ 05 Nov 2026 08:10:54Reported by GoogleType

osv_cleanstart🔗 osv.dev

Node users can delete node objects in Kubernetes via NodeRestriction admission controller.

Reporter	Title	Published	Views	Family All 550
IBM Security Bulletins	Security Bulletin: IBM Cloud Kubernetes Service is affected by a Kubernetes API server security vulnerability (CVE-2025-5187)	29 Sep 202511:41	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Concert Software.	10 Nov 202508:26	–	ibm
IBM Security Bulletins	Security Bulletin: Astronomer with IBM is vulnerable to object abuse due to Kubernetes (CVE-2025-5187)	28 Nov 202519:09	–	ibm
IBM Security Bulletins	Security Bulletin: ELM on Hybrid Cloud vulnerabilities addressed in 1.3.0	9 Mar 202613:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite uses k8s.io/kubernetes v1.33.1 which is vulnerable to CVE-2025-4563 and CVE-2025-5187	3 Feb 202610:39	–	ibm
BDU FSTEC	NodeRestriction Plugin Privilege Escalation	8 Sep 202500:00	–	bdu_fstec
Chainguard	CVE-2025-5187 vulnerabilities	29 Aug 202514:16	–	cgr
Circl	CVE-2025-5187	14 Aug 202501:07	–	circl
CNNVD	Kubernetes security vulnerabilities	27 Aug 202500:00	–	cnnvd
CVE	CVE-2025-5187	27 Aug 202516:20	–	cve

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RQ66683.json
osv	www.osv.dev/vulnerability/CVE-2025-5187
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-5187

05 Nov 2026 08:30Current

7.1High risk

Vulners AI Score7.1

CVSS 3.16.7

EPSS0.00574

Kubernetes NodeRestriction admission controller nfs-subdir-external-provisioner OwnerReference delete node object