GitHub Advisoryadvisory · Go

GHSA-r6j8-c6r2-37rr kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

MEDIUM Published 2025-12-15 Modified 2025-12-20 Official page ↗
Aliases
CVE-2025-13281
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Weaknesses
CWE-918
Reviewed
2025-12-16

Affected packages

• Go k8s.io/kubernetes: < 1.32.10 → fixed in 1.32.10 • Go k8s.io/kubernetes: >= 1.33.0-alpha.0, < 1.33.6 → fixed in 1.33.6 • Go k8s.io/kubernetes: >= 1.34.0-alpha.0, < 1.34.2 → fixed in 1.34.2

Description

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).

Related

Alias · CVE (1)

  • CVE-2025-13281 A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx… vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References