--- id: CVE-2025-5187 title: >- kubernetes: kube-apiserver: Nodes can delete themselves by adding an OwnerReference (CVE-2025-5187) summary: >- A vulnerability was found in the kube-apiserver's NodeRestriction admission controller, where node users can delete their corresponding node object by setting their own OwnerReference to a cluster-scoped resource. This flaw allows an attac… severity: medium cvss: 6.7 cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:L' cvssSource: vendor cwe: CWE-306 vendor: Red Hat product: Red Hat OpenShift Container Platform 4 affected: - openshift_container_platform 4 - openshift_container_platform 4.18 - openshift_container_platform 4.19 patched: - openshift_container_platform 4.18 - openshift_container_platform 4.19 published: '2025-08-12' updated: '2026-09-21' sourceUpdated: '2026-09-21T17:23:16+00:00' source: CSAF sourceUrl: 'https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5187.json' references: - url: >- https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5187.json - url: 'https://access.redhat.com/security/cve/CVE-2025-5187' - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=2375801' - url: 'https://www.cve.org/CVERecord?id=CVE-2025-5187' - url: 'https://nvd.nist.gov/vuln/detail/CVE-2025-5187' - url: 'https://github.com/kubernetes/kubernetes/issues/133471' - url: 'https://access.redhat.com/errata/RHBA-2025:15714' - url: 'https://access.redhat.com/errata/RHBA-2025:15694' - url: >- https://github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0f - url: 'https://github.com/kubernetes/kubernetes' - url: 'https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE' tags: - csaf - vex - red-hat - osv - go epss: 0.00543 epssPercentile: 0.44524 aliases: - GHSA-4x4m-3c2p-qppc - GO-2025-3915 ecosystem: go ingestedAt: '2026-09-12T03:13:01.754Z' --- ## Overview A vulnerability was found in the kube-apiserver's NodeRestriction admission controller, where node users can delete their corresponding node object by setting their own OwnerReference to a cluster-scoped resource. This flaw allows an attacker to delete and recreate its node object, leading to the node being recreated with modified taints or labels, which should not be allowed in this context. This may let the attacker control which pods are running on the compromised node. ## Vendor advisories - **RHBA-2025:15714** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.18 · released 2025-09-17 · [advisory](https://access.redhat.com/errata/RHBA-2025:15714) - **RHBA-2025:15694** · Red Hat · fixed in: Red Hat OpenShift Container Platform 4.19 · released 2025-09-16 · [advisory](https://access.redhat.com/errata/RHBA-2025:15694) - **Red Hat VEX** · Moderate · affected: Red Hat OpenShift Container Platform 4 · no fix planned: Red Hat OpenShift Container Platform 4 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2025/cve-2025-5187.json) **kubernetes: kube-apiserver: Nodes can delete themselves by adding an OwnerReference** — rated Moderate by Red Hat. Released 2025-08-12, updated 2026-09-21. Affected: - Red Hat OpenShift Container Platform 4 Fixed: - Red Hat OpenShift Container Platform 4.18 - Red Hat OpenShift Container Platform 4.19 No fix planned: - Red Hat OpenShift Container Platform 4 Not affected: - Red Hat OpenShift Container Platform 4.18 - Red Hat OpenShift Container Platform 4.19 ## Remediation For OpenShift Container Platform 4.18 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.18/html/release_notes/ You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follow… https://access.redhat.com/errata/RHBA-2025:15714 For OpenShift Container Platform 4.19 see the following documentation, which will be updated shortly for this release, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.redhat.com/en/documentation/openshift_container_platform/4.19/html/release_notes/ You can download the oc tool and use it to inspect release image metadata for x86_64, s390x, ppc64le, and aarch64 architectures. The image digests can be found at https://quay.io/repository/openshift-release-dev/ocp-release?tab=tags. The sha values for the release are as follow… https://access.redhat.com/errata/RHBA-2025:15694 Workarounds / mitigations: - This vulnerability can be mitigated by enabling the OwnerReferencesPermissionEnforcement admission controller, which will prevent any user without delete permissions on an object from modifying the OwnerReferences on that object. Note that this admission controller will apply to all users and object types. ## Package advisory (CVE-2025-5187) Affected packages: - `k8s.io/kubernetes < 1.31.12` - `k8s.io/kubernetes >= 1.32.0-alpha.0, < 1.32.8` - `k8s.io/kubernetes >= 1.33.0-alpha.0, < 1.33.4` Patched in: - `k8s.io/kubernetes 1.31.12` - `k8s.io/kubernetes 1.32.8` - `k8s.io/kubernetes 1.33.4` Source: https://osv.dev/vulnerability/GHSA-4x4m-3c2p-qppc