CVE-2025-5187 is a vulnerability in the kube-apiserver's NodeRestriction admission controller within Red Hat OpenShift Container Platform. It allows node users with sufficient privileges to delete their corresponding node object by setting their own OwnerReference to a cluster-scoped resource. This flaw enables an attacker to delete and recreate the node object with modified taints or labels, which should not be permitted. The vulnerability requires the attacker to have a high privileged account with node creation permissions. The issue is addressed by enabling the OwnerReferencesPermissionEnforcement admission controller, which restricts modification of OwnerReferences to users with delete permissions on the object. The fix is included in OpenShift Container Platform versions 4.18.24 and 4.19.12.

An attacker with high privileges capable of creating nodes can delete and recreate their node object with altered taints or labels. This may allow the attacker to control pod scheduling on the compromised node, potentially affecting workload placement and cluster behavior. The vulnerability has a medium severity rating and does not require user interaction. There are no known exploits in the wild.

Upgrade to Red Hat OpenShift Container Platform versions 4.18.24 or 4.19.12 or later, which include fixes for this vulnerability. Additionally, enable the OwnerReferencesPermissionEnforcement admission controller to prevent users without delete permissions from modifying OwnerReferences on objects. Follow Red Hat's official upgrade and configuration guidance to fully apply these updates and mitigations.