CVE-2025-13281: Portworx Half-Blind SSRF in kube-controller-manager
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
Other sources
Portworx Half-Blind SSRF in kube-controller-manager
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.34.2 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.33.6 - Upgrade
Upgrade
go/k8s.io/kubernetesto a version that resolves this vulnerability.Fixed in 1.32.10 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch CVE-2025-13281 - Configuration
To mitigate the half-blind SSRF vulnerability in kube-controller-manager when using the in-tree Portworx StorageClass, enable the CSIMigrationPortworx feature gate.
kube-controller-manager CSIMigrationPortworx = enable
Event History
Frequently Asked Questions
What is the severity of CVE-2025-13281?
CVE-2025-13281 is classified as a critical severity vulnerability, allowing an attacker to leak sensitive information.
How do I fix CVE-2025-13281?
To fix CVE-2025-13281, upgrade the kube-controller-manager to version 1.34.2 or later.
Which software versions are affected by CVE-2025-13281?
CVE-2025-13281 affects kube-controller-manager versions before 1.34.2, including 1.33.6 and 1.32.10.
Who is at risk from CVE-2025-13281?
Authorized users of kubernetes who utilize in-tree Portworx StorageClass are at risk from CVE-2025-13281.
What type of vulnerability is CVE-2025-13281?
CVE-2025-13281 is a half-blind Server Side Request Forgery (SSRF) vulnerability.