CVE-2025-13281
CVE-2025-13281 · Portworx Half-Blind SSRF in kube-controller-manager
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
CVSS 5.8 · Medium · EPSS 0.4% · Fix available
- Published
- Updated
Stack: system · containers
Affected products and versions
kubernetes
- Versions
- ≥ v1.30.0, ≤ v1.30.14: Affected (custom)
- ≥ v1.31.0, ≤ v1.31.14: Affected (custom)
- ≥ v1.32.0, ≤ v1.32.9: Affected (custom)
- ≥ v1.33.0, ≤ v1.33.5: Affected (custom)
- ≥ v1.34.0, ≤ v1.34.1: Affected (custom)
No fix published
kubernetes Debian:12
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1
kubernetes Debian:13
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1
kubernetes Debian:14
- Affected ranges
- ECOSYSTEM: < 1.20.5+really1.20.2-1
Update to 1.20.5+really1.20.2-1