CVE-2025-13281 — Server-Side Request Forgery in Kubernetes
Severity
5.8MEDIUMNVD
EPSS
0.0%
top 97.54%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedDec 14
Latest updateDec 16
Description
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:NExploitability: 1.3 | Impact: 4.0
Affected Packages3 packages
🔴Vulnerability Details
5OSV▶
Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes↗2025-12-16
OSV▶
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass↗2025-12-15
GHSA▶
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass↗2025-12-15
OSV▶
CVE-2025-13281: A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass↗2025-12-14