CVE-2025-13281

Name of the Vulnerable Software and Affected Versions kube-controller-manager (affected versions not specified)

Description An issue exists in kube-controller-manager when utilizing the in-tree Portworx StorageClass, allowing authorized users to potentially leak information from unprotected endpoints within the control plane’s host network. This includes link-local and loopback services. The issue is a half-blind Server Side Request Forgery (SSRF).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.