PT-2025-49178 · Unknown+2 · Kube-Controller-Manager+2

CVE-2025-13281

·

Published

2025-12-04

·

Updated

2026-07-30

CVSS v3.1

5.8

Medium

VectorAV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions kube-controller-manager (affected versions not specified)
Description An issue exists in kube-controller-manager when utilizing the in-tree Portworx StorageClass, allowing authorized users to potentially leak information from unprotected endpoints within the control plane’s host network. This includes link-local and loopback services. The issue is a half-blind Server Side Request Forgery (SSRF).
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

SSRF

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-918

Related Identifiers

AZL-72382
AZL-72386
BDU:2026-03571
CLEANSTART-2026-CM33443
CLEANSTART-2026-EA72772
CLEANSTART-2026-ES72297
CLEANSTART-2026-HT21055
CLEANSTART-2026-JW97006
CLEANSTART-2026-KQ90880
CLEANSTART-2026-ST87963
CLEANSTART-2026-VI42371
CLEANSTART-2026-VJ54611
CVE-2025-13281
ECHO-D43D-BAC8-84E2
GHSA-R6J8-C6R2-37RR
GO-2025-4240
OESA-2025-2815
OESA-2025-2816
OESA-2025-2817
OESA-2025-2818
OESA-2025-2819
OESA-2026-1162
OPENSUSE-SU-2026:21483-1
SUSE-SU-2026:0037-1

Affected Products

Portworx Storageclass
Red Os
Kube-Controller-Manager