CVE-2025-5187
Nodes can delete themselves by adding an OwnerReference
Reported by kubernetes · Published August 27, 2025
k8s.io/kubernetes is fixed in 1.33.4, 1.32.8 and 1.31.12 (Go Modules)
A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.
Fixed versions
Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.
| Package | Ecosystem | Fixed in |
|---|---|---|
| k8s.io/kubernetes | Go Modules | 1.33.4, 1.32.8, 1.31.12 |
| azuredisk-csi-fips-1.33 | Chainguard | 1.33.4-r1 |
| rancher-webhook-0.6 | Chainguard | 0.6.10-r1 |
| rancher-agent-2.10 | Wolfi | 2.10.9-r1 |
| eks-distro-1.31 | Chainguard | 1.31.35-r1 |
| docker-machine-driver-harvester | Wolfi | 1.0.6-r4 |
| azuredisk-csi-fips-1.31 | Chainguard | 1.31.11-r3 |
| local-static-provisioner-fips | Chainguard | 2.9.0-r0 |
| azurefile-csi-fips-1.32 | Chainguard | 1.32.5-r4 |
| kubernetes-csi-driver-hostpath | Wolfi | 1.17.0-r4 |
| aws-efs-csi-driver-fips | Chainguard | 2.1.11-r1 |
| kubernetes-csi-driver-hostpath | Chainguard | 1.17.0-r4 |
84 more packages have a fixed version. See every fix in Lookup.
Risk scores
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Kubernetes | Kubernetes | v1.31.0, v1.32.0, v1.33.0 |
| chainguard | azuredisk-csi-fips-1.33 | 0 |
| chainguard | rancher-webhook-0.6 | 0 |
| wolfi | rancher-agent-2.10 | 0 |
| chainguard | eks-distro-1.31 | 0 |
| wolfi | docker-machine-driver-harvester | 0 |
| chainguard | azuredisk-csi-fips-1.31 | 0 |
| chainguard | local-static-provisioner-fips | 0 |
| chainguard | azurefile-csi-fips-1.32 | 0 |
| wolfi | kubernetes-csi-driver-hostpath | 0 |
| chainguard | aws-efs-csi-driver-fips | 0 |
| chainguard | kubernetes-csi-driver-hostpath | 0 |
| chainguard | azure-container-networking | 0 |
| wolfi | rancher-2.12 | 0 |
| chainguard | blob-csi-1.24 | 0 |
| Kubernetes | Kubernetes | 1.31.0, 1.33.0, 1.32.0 |
| wolfi | azurefile-csi-1.32 | 0 |
| chainguard | longhorn-share-manager-fips-1.8 | 0 |
| k8s.io | kubernetes | 0, 1.33.0-alpha.0, 1.32.0-alpha.0 |
| chainguard | mesosphere-vsphere-csi-fips | * |
…and 83 more
Timeline
- Aug 13, 2025 CVE Published
- Aug 27, 2025 Coalition ESS Score (11 in total, the first dated here)
- Aug 28, 2025 EPSS Score (30 in total, the first dated here)
- Feb 26, 2026 CVE Updated
- Mar 10, 2026 Security Advisory
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln CVE-2025-5187
vulnetix vdb fixes CVE-2025-5187Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/CVE-2025-5187/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart