diff -u b/core/modules/node/node.module b/core/modules/node/node.module
--- b/core/modules/node/node.module
+++ b/core/modules/node/node.module
@@ -1065,8 +1065,13 @@
   // Update the query for the given storage method.
   \Drupal::service('node.grant_storage')->alterQuery($query, $tables, $op, $account, $base_table);
 
-  // Bubble the 'user.node_grants:$op' cache context to the current render
-  // context.
+  // Code that performs a node_access query should explicitly add the
+  // 'user.node_grants:$op' cache context to the render element or
+  // \Drupal\Core\Cache\CacheableDependencyInterface object that is affected
+  // by the query. Doing so ensures that the context is attached to the most
+  // appropriate element or object. However, since cache contexts are new to
+  // Drupal 8, to safeguard route controllers or other code that forget to do
+  // this, here we also add it to the current render context.
   // @see \Drupal\Core\Render\MetadataBubblingUrlGenerator::bubble()
   // @todo Remove before Drupal 9.0.0.
   $renderer = \Drupal::service('renderer');