6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-5187

CVE-2025-5187: Kubernetes Nodes can delete themselves by adding an OwnerReference

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-5187

CVE-2025-5187:

6.7

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
k8s.io/kubernetes	go	< 1.31.12	1.31.12
k8s.io/kubernetes	go	>= 1.32.0-alpha.0, < 1.32.7	1.32.8
k8s.io/kubernetes	go	>= 1.33.0-alpha.0, < 1.33.4	1.33.4

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability lies within the NodeRestriction admission controller in Kubernetes, which is responsible for enforcing security policies on node objects. The core of the issue is a missing authorization check in the admitNode function. Before the patch, this function failed to validate whether a node was attempting to modify its own ownerReferences field.

An attacker with control over a node could send a patch request to modify their node object, adding an ownerReference that points to another resource. If this referenced resource did not exist or was later deleted, the Kubernetes garbage collector would see the node as an orphaned object and delete it. This would effectively allow a node to cause its own deletion, leading to a denial of service.

The provided patch directly addresses this flaw by introducing a new check within the admitNode function. It compares the ownerReferences of the old and new node objects in an update operation. If they are not identical, the request is rejected with a "Forbidden" error. This ensures that nodes can no longer manipulate their ownerReferences and trigger their own deletion through this mechanism.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.