CVE-2025-13281

medium

Description

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).

References

https://groups.google.com/g/kubernetes-security-announce/c/EORqZg0k1l4/m/TtD-q0v7AgAJ

https://github.com/kubernetes/kubernetes/issues/135525

https://euvd.enisa.europa.eu/vulnerability/EUVD-2025-203310

http://www.openwall.com/lists/oss-security/2025/12/01/4

Details

Source: Mitre, NVD

Published: 2025-12-14

Updated: 2026-04-15

Named Vulnerability: GO-2025-4240Named Vulnerability: GHSA-r6j8-c6r2-37rr

Risk Information

CVSS v2

Base Score: 4.6

Vector: CVSS2#AV:N/AC:H/Au:M/C:C/I:N/A:N

Severity: Medium

CVSS v3

Base Score: 5.8

Vector: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Severity: Medium

EPSS

EPSS: 0.00389