Vulnerability in NodeRestriction Admission Controller of Kubernetes

CVE-2025-5187

What is CVE-2025-5187?

A security flaw exists in the NodeRestriction admission controller within Kubernetes clusters, granting node users the ability to delete their respective node objects. This occurs when a user patches themselves with an OwnerReference pointing to a cluster-scoped resource. If that OwnerReference is not present or is removed, the corresponding node object is scheduled for deletion through the garbage collection process, which could lead to unintended consequences in cluster management and stability.

References