CVE-2025-13281
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
- CVSS 3.1
- 5.8
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N - EPSS
- 0.4% chance of exploitation in the next 30 days; higher than 32% of CVEs (scores of 2026-10-25)
- CWE
- CWE-918
- Published
- Modified
- Record from
- the NVD, synced
Packages (OSV)
| Advisory | Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|---|
| GHSA-r6j8-c6r2-37rr | Go | k8s.io/kubernetes | <1.32.10 | 1.32.10 |
| GHSA-r6j8-c6r2-37rr | Go | k8s.io/kubernetes | >=1.33.0-alpha.0 <1.33.6 | 1.33.6 |
| GHSA-r6j8-c6r2-37rr | Go | k8s.io/kubernetes | >=1.34.0-alpha.0 <1.34.2 | 1.34.2 |
| GO-2025-4240 | Go | k8s.io/kubernetes | <1.32.10 >=1.33.0-alpha.0 <1.33.6 >=1.34.0-alpha.0 <1.34.2 | 1.32.10, 1.33.6, 1.34.2 |