{"id":"CVE-2025-5187","title":"kubernetes: kube-apiserver: Nodes can delete themselves by adding an OwnerReference (CVE-2025-5187)","summary":"A vulnerability was found in the kube-apiserver's NodeRestriction admission controller, where node users can delete their corresponding node object by setting their own OwnerReference to a cluster-scoped resource. This flaw allows an attac…","severity":"medium","cvss":6.7,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L","cvssSource":"vendor","cwe":"CWE-306","vendor":"Red Hat","product":"Red Hat OpenShift Container Platform 4","affected":["openshift_container_platform 4","openshift_container_platform 4.18","openshift_container_platform 4.19"],"patched":["openshift_container_platform 4.18","openshift_container_platform 4.19"],"published":"2025-08-12","updated":"2026-09-21","sourceUpdated":"2026-09-21T17:23:16+00:00","source":"CSAF","sourceUrl":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5187.json","references":[{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5187.json"},{"url":"https://access.redhat.com/security/cve/CVE-2025-5187"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2375801"},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5187"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5187"},{"url":"https://github.com/kubernetes/kubernetes/issues/133471"},{"url":"https://access.redhat.com/errata/RHBA-2025:15714"},{"url":"https://access.redhat.com/errata/RHBA-2025:15694"},{"url":"https://github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0f"},{"url":"https://github.com/kubernetes/kubernetes"},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE"}],"tags":["csaf","vex","red-hat","osv","go"],"epss":0.00543,"epssPercentile":0.44502,"aliases":["GHSA-4x4m-3c2p-qppc","GO-2025-3915"],"ecosystem":"go","ingestedAt":"2026-09-12T03:13:01.754Z","slug":"CVE-2025-5187","body":"## Overview\n\nA vulnerability was found in the kube-apiserver's NodeRestriction admission controller, where node users can delete their corresponding node object by setting their own OwnerReference to a cluster-scoped resource. This flaw allows an attacker to delete and recreate its node object, leading to the node being recreated with modified taints or labels, which should not be allowed in this context. This may let the attacker control which pods are running on the compromised node.\n\n## Vendor advisories\n\n- **RHBA-2025:15714** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2025-09-17 · [advisory](https://access.redhat.com/errata/RHBA-2025:15714)\n- **RHBA-2025:15694** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2025-09-16 · [advisory](https://access.redhat.com/errata/RHBA-2025:15694)\n- **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5187.json)\n\n**kubernetes: kube-apiserver: Nodes can delete themselves by adding an OwnerReference** — rated Moderate by Red Hat. Released 2025-08-12, updated 2026-09-21.\n\nAffected:\n\n- Red Hat OpenShift Container Platform 4\n\nFixed:\n\n- Red Hat OpenShift Container Platform 4.18\n- Red Hat OpenShift Container Platform 4.19\n\nNo fix planned:\n\n- Red Hat OpenShift Container Platform 4\n\nNot affected:\n\n- Red Hat OpenShift Container Platform 4.18\n- Red Hat OpenShift Container Platform 4.19\n\n## Remediation\n\nFor OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/\nYou can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\nThe sha values for the release are as follow… https://access.redhat.com/errata/RHBA-2025:15714\nFor OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update:\nhttps://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/\nYou can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags.\nThe sha values for the release are as follow… https://access.redhat.com/errata/RHBA-2025:15694\n\nWorkarounds / mitigations:\n\n- This vulnerability can be mitigated by enabling the OwnerReferencesPermissionEnforcement admission controller, which will prevent any user without delete permissions on an object from modifying the OwnerReferences on that object.\n\nNote that this admission controller will apply to all users and object types.\n\n## Package advisory (CVE-2025-5187)\n\nAffected packages:\n\n- `k8s.io/kubernetes < 1.31.12`\n- `k8s.io/kubernetes >= 1.32.0-alpha.0, < 1.32.8`\n- `k8s.io/kubernetes >= 1.33.0-alpha.0, < 1.33.4`\n\nPatched in:\n\n- `k8s.io/kubernetes 1.31.12`\n- `k8s.io/kubernetes 1.32.8`\n- `k8s.io/kubernetes 1.33.4`\n\nSource: https://osv.dev/vulnerability/GHSA-4x4m-3c2p-qppc","depth":"sunlit","depthScore":37,"depthScoreParts":{"impact":36.9,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}