CVE-2025-5187 Nodes can delete themselves by adding an OwnerReference
A node can delete itself by adding an OwnerReference to a non-existent cluster-scoped resource, causing garbage collection to remove the node object.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-5187?
CVE-2025-5187 is a medium-severity missing authorization vulnerability in Kubernetes, published on 27 Aug 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Weakness: CWE-863
Which versions are affected by CVE-2025-5187?
7 open source packages ship an affected version, including k8s.io/kubernetes.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | All versions | 1.31.12, 1.32.8, 1.33.4 |
k8s.io/kubernetes Go | All versions | 1.31.12 |
k8s.io/kubernetes Go | All versions | 1.31.12 |
k8s.io/kubernetes Go | From 1.32.0-alpha.0 | 1.32.8 |
k8s.io/kubernetes Go | From 1.32.0-alpha.0 | 1.32.8 |
k8s.io/kubernetes Go | From 1.33.0-alpha.0 | 1.33.4 |
1 more packages
k8s.io/kubernetes Go | From 1.33.0-alpha.0 | 1.33.4 |
How do I fix CVE-2025-5187?
Upgrade k8s.io/kubernetes to a fixed version for your release line: 1.31.12, 1.32.8 or 1.33.4.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2025-5187 being exploited?
There is no known exploitation of CVE-2025-5187 in the wild and no public exploit code.
Sources
Also known as CLEANSTART-2026-GU62349, CLEANSTART-2026-JX65599, DEBIAN-CVE-2025-5187, ECHO-17d8-7195-e729, GHSA-4x4m-3c2p-qppc, GO-2025-3915 and 30 more.