Kubernetes NodeRestriction Admission Controller Self-Deletion Vulnerability

A vulnerability in the NodeRestriction admission controller allows node users to delete their node objects by patching themselves with an OwnerReference to a cluster-scoped resource. If the referenced resource is absent or deleted, the node object is removed through garbage collection. This issue affects Kubernetes clusters with NodeRestriction enabled but without the OwnerReferencesPermissionEnforcement admission controller. Vulnerable kube-apiserver versions include 1.31.11 and prior, 1.32.7 and prior, and 1.33.3 and prior.

Impact

Exploitation of this vulnerability allows a node to delete and recreate its node object with altered taints or labels, potentially enabling control over which pods are scheduled on the compromised node.

Remediation

Upgrade to a patched kube-apiserver version (1.31.12 or later, 1.32.8 or later, 1.33.4 or later) or enable the OwnerReferencesPermissionEnforcement admission controller.