Skip to content
CVE PROGRAM SOURCE RECORD5.8 Medium

CVE-2025-13281

Portworx Half-Blind SSRF in kube-controller-manager

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
kubernetes

Description

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Kubernetes Kubernetes

Default version status: unaffected

  • v1.30.0 to ≤ v1.30.14affected
  • v1.31.0 to ≤ v1.31.14affected
  • v1.32.0 to ≤ v1.32.9affected
  • v1.33.0 to ≤ v1.33.5affected
  • v1.34.0 to ≤ v1.34.1affected

References