{"id":"GHSA-r6j8-c6r2-37rr","revision":"5d21a312b98a48298fc18393c0098a63","records":[{"revision":"5d21a312b98a48298fc18393c0098a63","observedAt":"2026-10-24T13:19:41.952+00:00","statement":{"source":"osv","id":"GHSA-r6j8-c6r2-37rr","aliases":["CVE-2025-13281","GO-2025-4240"],"title":"kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass","description":"A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).","state":0,"publishedAt":"2025-12-15T00:30:25+00:00","modifiedAt":"2026-09-10T03:50:58.8234524+00:00","affected":[{"ecosystem":"Go","name":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"0"},{"kind":"fixed","version":"1.32.10"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.33.0-alpha.0"},{"kind":"fixed","version":"1.33.6"}]}],"versions":[],"rawVersionEvidence":null},{"ecosystem":"Go","name":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"kind":"introduced","version":"1.34.0-alpha.0"},{"kind":"fixed","version":"1.34.2"}]}],"versions":[],"rawVersionEvidence":null}],"metrics":[{"system":"CVSS_V3","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N","score":null,"severity":null},{"system":"Publisher rating","vector":null,"score":null,"severity":"MODERATE"}],"references":["https://nvd.nist.gov/vuln/detail/CVE-2025-13281","https://github.com/kubernetes/kubernetes/issues/135525","https://github.com/kubernetes/kubernetes/commit/7506ce804c20696ba32cdb72126270ceaed06e24","https://github.com/kubernetes/kubernetes/commit/97650c1c4fe15cbb7756ba95b3edc8a8665063ca","https://github.com/kubernetes/kubernetes/commit/dbe17dfe7773563eac95534040f413ada6d2b421","https://github.com/advisories/GHSA-r6j8-c6r2-37rr","https://github.com/kubernetes/kubernetes","https://groups.google.com/g/kubernetes-security-announce/c/EORqZg0k1l4/m/TtD-q0v7AgAJ","http://www.openwall.com/lists/oss-security/2025/12/01/4"],"sourceUrl":"https://github.com/advisories/GHSA-r6j8-c6r2-37rr","license":"GitHub Advisory Database · CC-BY-4.0","key":"osv:GHSA-r6j8-c6r2-37rr","identifiers":["GHSA-r6j8-c6r2-37rr","CVE-2025-13281","GO-2025-4240"]},"retained":false,"historicalAffected":[]}],"coverage":[]}