CVE-2025-13281
CVE.org · Published
- Record status
- Published
- Identifier year (not publication year)
- 2025
- Source publication
- Source updated
- Imported by cveboard
- Source snapshot
- cve_2026-10-24_midnight_baseline ·
CNA source text (English)
Portworx Half-Blind SSRF in kube-controller-manager
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
Scoped product and version facts
Fix information unknown; no fixed version is derived here. Missing information does not prove that no fix exists.
Exploitation unknown; this catalogue does not assess exploitation.
Kubernetes
- Vendor
- Kubernetes
- Product
- Kubernetes
- Platforms
- Unknown
- Default status
unaffected
| Version (version) | Status (status) | Version scheme (versionType) | Exclusive end (lessThan) | Inclusive end (lessThanOrEqual) | Status changes (at → status) |
|---|---|---|---|---|---|
| v1.30.0 | affected | custom | Unavailable | v1.30.14 | None listed |
| v1.31.0 | affected | custom | Unavailable | v1.31.14 | None listed |
| v1.32.0 | affected | custom | Unavailable | v1.32.9 | None listed |
| v1.33.0 | affected | custom | Unavailable | v1.33.5 | None listed |
| v1.34.0 | affected | custom | Unavailable | v1.34.1 | None listed |