TI-2025-04656 Aliases CVE-2025-5187 GHSA-4x4m-3c2p-qppc

Nodes can delete themselves by adding an OwnerReference

LOW 32CWE-863Published 2025-08-27 · Updated 2026-02-26

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · Low
Fix status: Partial Red Hat: 2 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-863.

Summary

A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding node object by patching themselves with an OwnerReference to a cluster-scoped resource. If the OwnerReference resource does not exist or is subsequently deleted, the given node object will be deleted via garbage collection.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00574 47th percentileScored 2026-11-07

Fix Partial k8s.io/kubernetes (Go): 1.31.12, 1.32.8, 1.33.4Red Hat: 2 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Kubernetes	Kubernetes	v1.31.0 – v1.31.11; v1.32.0 – v1.32.7; v1.33.0 – v1.33.3	—	No fix listed	CNA
—	k8s.io/kubernetes (Go)	before 1.31.12	1.31.12	Patch available	GHSA-4x4m-3c2p-qppc
—	k8s.io/kubernetes (Go)	1.32.0-alpha.0 to before 1.32.8	1.32.8	Patch available	GHSA-4x4m-3c2p-qppc
—	k8s.io/kubernetes (Go)	1.33.0-alpha.0 to before 1.33.4	1.33.4	Patch available	GHSA-4x4m-3c2p-qppc

Kubernetes VendorKubernetes Affected v1.31.0 – v1.31.11; v1.32.0 – v1.32.7; v1.33.0 – v1.33.3 Fixed in — No fix listed CNA
k8s.io/kubernetes (Go) Vendor— Affected before 1.31.12 Fixed in 1.31.12 Patch available GHSA-4x4m-3c2p-qppc
k8s.io/kubernetes (Go) Vendor— Affected 1.32.0-alpha.0 to before 1.32.8 Fixed in 1.32.8 Patch available GHSA-4x4m-3c2p-qppc
k8s.io/kubernetes (Go) Vendor— Affected 1.33.0-alpha.0 to before 1.33.4 Fixed in 1.33.4 Patch available GHSA-4x4m-3c2p-qppc

CPE names Threatist (inferred) · 1

Inferred from how NVD named this product before; not given by a source.

CPE	Versions	Role	Vendor
cpe:2.3:a:kubernetes:kubernetes::::::::	—	—	Kubernetes

cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions — — ·Kubernetes

Remediation

Fix · GHSA-4x4m-3c2p-qppc k8s.io/kubernetes (Go) Fixed in 1.31.12 Advisory →
Fix · GHSA-4x4m-3c2p-qppc k8s.io/kubernetes (Go) Fixed in 1.32.8 Advisory →
Fix · GHSA-4x4m-3c2p-qppc k8s.io/kubernetes (Go) Fixed in 1.33.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Product	Status	Plan or fix
Red Hat OpenShift Container Platform 4	Affected	No fix yet: Fix deferred
Red Hat OpenShift Container Platform 4.18	Fixed	—
Red Hat OpenShift Container Platform 4.19	Fixed	—

Not affected: 2 products

Red Hat OpenShift Container Platform 4.18
Red Hat OpenShift Container Platform 4.19

Timeline

2026-10-02 Threatist record created from CVE-2025-5187
2026-10-03 Alias added: GHSA-4x4m-3c2p-qppc

References

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2025-5187

Other 4

TI-2025-01719 ingress-nginx admission controller RCE escalation CVSS 3.1CRITICAL 9.8
TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
TI-2025-00932 ingress-nginx controller - configuration injection via unsanitized mirror annotations CVSS 3.1HIGH 8.8
TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
TI-2026-02839 ingress-nginx rewrite-target nginx configuration injection CVSS 3.1HIGH 8.8
TI-2025-18233 ingress-nginx controller - configuration injection via unsanitized auth-url annotation CVSS 3.1HIGH 8.8

See all 126 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences