CVE-2025-5187: Nodes can delete themselves by adding an OwnerReference

Deferred

AliasesDEBIAN-CVE-2025-5187CGA-23mx-gjgx-3gjjCGA-2588-xxv7-9cpr+415 more

Published 27-08-2025Last modified 26-02-2026

Vulnerability summary

CVE-2025-5187 is a medium (CVSS 6.7) Incorrect Authorization vulnerability in kubernetes. EPSS estimates a 0.57% chance of exploitation in the next 30 days, higher than 47.4% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 6.7, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

6.7/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.57%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Timeline

27-08-2025
PublishedVulnerability first disclosed.
26-02-2026
Last modifiedVulnerability information updated.

Description

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

CVSS metrics

6 scores · 6 sources · 1 version

v3.16.7

EPSS trend

Probability

0.57%

Chance of exploitation in the next 30 days

Percentile

47%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.57% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-863Incorrect AuthorizationThe product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Affected systems

Version check

Known conditions: network-reachable, administrative account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Chainguard184 products

argo-cd-2.13< 2.13.8-r5
argo-cd-2.13-compat< 2.13.8-r5
argo-cd-2.13-repo-server< 2.13.8-r5
argo-cd-2.14< 2.14.15-r4
argo-cd-2.14-compat< 2.14.15-r4

argo-cd-2.14-repo-server< 2.14.15-r4
argo-cd-fips-2.14< 2.14.15-r4
argo-cd-fips-2.14-compat< 2.14.15-r4
argo-cd-fips-2.14-repo-server< 2.14.15-r4
argo-cd-fips-3.0< 3.0.13-r1
argo-cd-fips-3.0-compat< 3.0.13-r1
argo-cd-fips-3.0-iamguarded-compat< 3.0.13-r1
argo-cd-fips-3.0-repo-server< 3.0.13-r1
argo-cd-fips-3.1< 3.1.1-r1
argo-cd-fips-3.1-compat< 3.1.1-r1
argo-cd-fips-3.1-iamguarded-compat< 3.1.1-r1
argo-cd-fips-3.1-repo-server< 3.1.1-r1
argo-rollouts< 1.9.0-r0
argo-rollouts-fips< 1.9.0-r0
argocd-image-updater-fips< 0.16.0-r8
aws-efs-csi-driver-fips< 2.1.11-r1
azure-vnet-cni< 1.7.9-r0
azuredisk-csi-1.28All versions (No fix recorded)
azuredisk-csi-1.29All versions (No fix recorded)
azuredisk-csi-1.30All versions (No fix recorded)
azuredisk-csi-1.31< 1.31.11-r4
azuredisk-csi-1.31-compat< 1.31.11-r4
azuredisk-csi-1.32< 1.32.10-r1
azuredisk-csi-1.32-compat< 1.32.10-r1
azuredisk-csi-fips-1.28All versions (No fix recorded)
azuredisk-csi-fips-1.29All versions (No fix recorded)
azuredisk-csi-fips-1.30All versions (No fix recorded)
azuredisk-csi-fips-1.31< 1.31.11-r3
azuredisk-csi-fips-1.32< 1.32.10-r1
azuredisk-csi-fips-1.33< 1.33.4-r1
azurefile-csi-1.29All versions (No fix recorded)
azurefile-csi-1.30All versions (No fix recorded)
azurefile-csi-1.31< 1.31.8-r3
azurefile-csi-1.32< 1.32.5-r4
azurefile-csi-1.32-compat< 1.32.5-r4
azurefile-csi-fips-1.29All versions (No fix recorded)
azurefile-csi-fips-1.30All versions (No fix recorded)
azurefile-csi-fips-1.31< 1.31.8-r3 | < 1.31.8-r2
azurefile-csi-fips-1.32< 1.32.5-r4
azurefile-csi-fips-1.32-compat< 1.32.5-r4
azurefile-csi-fips-1.33< 1.33.4-r1
azurefile-csi-fips-1.33-compat< 1.33.4-r1
blob-csi-1.23< 1.23.11-r61
blob-csi-1.24< 1.24.11-r10
blob-csi-fips-1.23< 1.23.11-r62
blob-csi-fips-1.24< 1.24.11-r10
blob-csi-fips-1.25< 1.25.9-r5
blob-csi-fips-1.25-compat< 1.25.9-r5
blob-csi-fips-1.26< 1.26.7-r1
blob-csi-fips-1.26-compat< 1.26.7-r1
calico-apiserver-3.29All versions (No fix recorded)
calico-apiserver-fips-3.29All versions (No fix recorded)
calico-felix-3.29All versions (No fix recorded)
calico-felix-fips-3.29All versions (No fix recorded)
calico-node-3.29All versions (No fix recorded)
calico-node-fips-3.29All versions (No fix recorded)
cephcsi< 3.15.0-r2
cephcsi-compat< 3.15.0-r2
cephcsi-fips< 3.15.0-r2
cluster-autoscaler-1.31< 1.31.3-r3
cluster-autoscaler-1.31-compat< 1.31.3-r3
cluster-autoscaler-fips-1.31< 1.31.3-r4
cluster-autoscaler-fips-1.31-compat< 1.31.3-r4
cluster-autoscaler-fips-1.33< 1.33.0-r4
cluster-autoscaler-fips-1.33-compat< 1.33.0-r4
docker-machine-driver-harvester< 1.0.6-r4
eks-distro-kube-apiserver-1.29All versions (No fix recorded)
eks-distro-kube-apiserver-1.30All versions (No fix recorded)
eks-distro-kube-apiserver-1.31< 1.31.35-r1
eks-distro-kube-apiserver-1.32< 1.32.28-r1
eks-distro-kube-apiserver-fips-1.29All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.30All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.31< 1.31.35-r1
eks-distro-kube-apiserver-fips-1.32< 1.32.28-r1 | < 1.32.28-r0
eks-distro-kube-controller-manager-1.29All versions (No fix recorded)
eks-distro-kube-controller-manager-1.30All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.29All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.30All versions (No fix recorded)
eks-distro-kube-proxy-1.29All versions (No fix recorded)
eks-distro-kube-proxy-1.30All versions (No fix recorded)
eks-distro-kube-proxy-fips-1.29All versions (No fix recorded)
eks-distro-kube-proxy-fips-1.30All versions (No fix recorded)
eks-distro-kube-scheduler-1.29All versions (No fix recorded)
eks-distro-kube-scheduler-1.30All versions (No fix recorded)
eks-distro-kube-scheduler-fips-1.29All versions (No fix recorded)
eks-distro-kube-scheduler-fips-1.30All versions (No fix recorded)
emissary< 3.10.0-r9
emissary-apiext< 3.10.0-r9
emissary-oci-entrypoint< 3.10.0-r9
ip-masq-agent< 2.12.0-r12
k8ssandra-client< 0.8.2-r2
k8ssandra-client-compat< 0.8.2-r2
k8ssandra-client-fips< 0.8.2-r2
kapp< 0.64.2-r3
kapp-fips< 0.64.2-r5
kube-apiserver-1.32< 1.32.11-r0
kube-apiserver-1.32-default< 1.32.11-r0
kube-apiserver-1.32-default-compat< 1.32.11-r0
kube-controller-manager-1.32< 1.32.11-r0
kube-controller-manager-1.32-default< 1.32.11-r0
kube-controller-manager-1.32-default-compat< 1.32.11-r0
kube-proxy-1.32< 1.32.11-r0
kube-proxy-1.32-default< 1.32.11-r0
kube-proxy-1.32-default-compat< 1.32.11-r0
kube-scheduler-1.32< 1.32.11-r0
kube-scheduler-1.32-default< 1.32.11-r0
kube-scheduler-1.32-default-compat< 1.32.11-r0
kubeadm-1.32< 1.32.11-r0
kubeadm-1.32-default< 1.32.11-r0
kubeadm-1.32-default-compat< 1.32.11-r0
kubectl-1.30All versions (No fix recorded)
kubectl-1.32< 1.32.11-r0
kubectl-1.32-default< 1.32.11-r0
kubectl-1.32-default-compat< 1.32.11-r0
kubectl-1.32-iamguarded-compat< 1.32.11-r0
kubectl-argo-rollouts< 1.9.0-r0
kubectl-argo-rollouts-fips< 1.9.0-r0
kubectl-bash-completion-1.32< 1.32.11-r0
kubelet-1.32< 1.32.11-r0
kubelet-1.32-default< 1.32.11-r0
kubelet-1.32-default-compat< 1.32.11-r0
kubernetes-1.30All versions (No fix recorded)
kubernetes-1.32< 1.32.11-r0
kubernetes-1.32-default< 1.32.11-r0
kubernetes-csi-driver-hostpath< 1.17.0-r4
kubernetes-csi-driver-nfs< 4.11.0-r6
kubernetes-csi-driver-nfs-compat< 4.11.0-r6
kubernetes-csi-driver-nfs-fips< 4.11.0-r6
kubernetes-csi-driver-nfs-fips-compat< 4.11.0-r6
kubernetes-dns-node-cache< 1.26.7-r0
kubernetes-dns-node-cache-fips< 1.26.7-r1
kubernetes-pause-1.32< 1.32.11-r0
kubernetes-pause-compat-1.32< 1.32.11-r0
local-static-provisioner< 2.9.0-r0
local-static-provisioner-fips< 2.9.0-r0
local-volume-node-cleanup< 2.9.0-r0
local-volume-node-cleanup-compat< 2.9.0-r4
local-volume-node-cleanup-fips< 2.9.0-r0
longhorn-share-manager-1.8< 1.8.2-r2
longhorn-share-manager-1.8-compat< 1.8.2-r2
longhorn-share-manager-fips-1.8< 1.8.2-r3
longhorn-share-manager-fips-1.8-compat< 1.8.2-r3
mesosphere-vsphere-csi< 3.5.0-r2
mesosphere-vsphere-csi-driver< 3.5.0-r2
mesosphere-vsphere-csi-driver-fipsAll versions (No fix recorded)
mesosphere-vsphere-csi-syncer< 3.5.0-r2
mesosphere-vsphere-csi-syncer-fipsAll versions (No fix recorded)
node-feature-discovery-0.16< 0.16.9-r2
node-feature-discovery-fips-0.16-kubectl-nfd< 0.16.9-r2
node-feature-discovery-fips-0.17< 0.17.3-r4
node-feature-discovery-fips-0.17-gc< 0.17.3-r4
node-feature-discovery-fips-0.17-kubectl-nfd< 0.17.3-r4
node-feature-discovery-fips-0.17-master< 0.17.3-r4
node-feature-discovery-fips-0.17-topology-updater< 0.17.3-r4
node-feature-discovery-fips-0.17-worker< 0.17.3-r4
nodetaint< 0.0.4-r36
py3.10-ambassador< 3.10.0-r9
py3.11-ambassador< 3.10.0-r9
py3.12-ambassador< 3.10.0-r9
py3.13-ambassador< 3.10.0-r9
rancher-2.10< 2.10.9-r1
rancher-2.11< 2.11.5-r0
rancher-2.12< 2.12.1-r0
rancher-agent-2.10< 2.10.9-r1
rancher-agent-2.11< 2.11.5-r0
rancher-agent-2.12< 2.12.1-r0
rancher-agent-2.9All versions (No fix recorded)
rancher-system-agent< 0.3.13-r2
rancher-webhook-0.4All versions (No fix recorded)
rancher-webhook-0.5All versions (No fix recorded)
rancher-webhook-0.6< 0.6.10-r1
rancher-webhook-fips-0.4All versions (No fix recorded)
rancher-webhook-fips-0.5All versions (No fix recorded)
rancher-webhook-fips-0.6< 0.6.10-r1
vcluster< 0.27.0-r2
vcluster-cli< 0.27.0-r2
vcluster-syncer< 0.27.0-r2
yunikorn-k8shim< 1.7.0-r3
yunikorn-k8shim-fips< 1.7.0-r4

Show all 184

Wolfi16 products

argo-rollouts< 1.9.0-r0
docker-machine-driver-harvester< 1.0.6-r4
emissary< 3.10.0-r9
emissary-apiext< 3.10.0-r9
emissary-oci-entrypoint< 3.10.0-r9

Show all 16

2 vendors · 200 products · Showing 200 of 221

References

8 links

github.com/kubernetes/kubernetes/issues/133471Issue TrackingREPORTWEB
groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztEMailing ListARTICLEWEB
security-tracker.debian.org/tracker/CVE-2025-5187Advisory
github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5187.jsonAdvisory
nvd.nist.gov/vuln/detail/CVE-2025-5187Advisory
github.com/kubernetes/kubernetes/commit/a2d98cac56a0c5cb2d8abc4d087fc00846b3bc0fWEBFIX
github.com/kubernetes/kubernetesPACKAGE
github.com/advisories/GHSA-4x4m-3c2p-qppcAdvisory