CVE-2025-13281
Medium · 5.8CVSS
5.8
EPSS
0.4%
Published
Dec 14, 2025
CISA due date
—
The record
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | k8s.io/kubernetes | 0 | 1.32.10 |
| Go | k8s.io/kubernetes | 1.33.0-alpha.0 | 1.33.6 |
| Go | k8s.io/kubernetes | 1.34.0-alpha.0 | 1.34.2 |
| Chainguard | argo-cd-2.13-repo-server | 0 | 2.13.9-r5 |
| Chainguard | argo-cd-2.14-repo-server | 0 | 2.14.21-r4 |
| Chainguard | argo-cd-3.0 | 0 | 3.0.20-r8 |
| Chainguard | argo-cd-3.0-compat | 0 | 3.0.20-r8 |
| Chainguard | argo-cd-3.0-iamguarded-compat | 0 | 3.0.20-r8 |
| Chainguard | argo-cd-3.0-repo-server | 0 | 3.0.20-r8 |
| Chainguard | argo-cd-3.1 | 0 | 3.1.9-r7 |
| Chainguard | argo-cd-3.1-compat | 0 | 3.1.9-r7 |
| Chainguard | argo-cd-3.1-iamguarded-compat | 0 | 3.1.9-r7 |
| Chainguard | argo-cd-3.1-repo-server | 0 | 3.1.9-r7 |
| Chainguard | argo-cd-3.2 | 0 | 3.2.2-r0 |
| Chainguard | argo-cd-3.2-compat | 0 | 3.2.1-r4 |
| Chainguard | argo-cd-3.2-iamguarded-compat | 0 | 3.2.1-r4 |
| Chainguard | argo-cd-3.2-repo-server | 0 | 3.2.1-r4 |
| Chainguard | argo-cd-fips-2.13-repo-server | 0 | 2.13.9-r5 |
| Chainguard | argo-cd-fips-2.14-repo-server | 0 | 2.14.21-r4 |
| Chainguard | argo-cd-fips-3.0 | 0 | 3.0.20-r9 |
| Chainguard | argo-cd-fips-3.0-compat | 0 | 3.0.20-r9 |
| Chainguard | argo-cd-fips-3.1 | 0 | 3.1.9-r10 |
| Chainguard | argo-cd-fips-3.1-compat | 0 | 3.1.9-r9 |
| Chainguard | argo-cd-fips-3.1-iamguarded-compat | 0 | 3.1.9-r9 |
| Chainguard | argo-cd-fips-3.1-repo-server | 0 | 3.1.9-r9 |
| Chainguard | argo-cd-fips-3.2-compat | 0 | 3.2.1-r3 |
| Chainguard | argocd-image-updater | 0 | 1.0.2-r1 |
| Chainguard | argocd-image-updater-compat | 0 | 1.0.2-r1 |
| Chainguard | argocd-image-updater-fips | 0 | 1.0.2-r1 |
| Chainguard | aws-efs-csi-driver | 0 | 2.2.0-r1 |
| Chainguard | aws-efs-csi-driver-fips | 0 | 2.2.0-r1 |
| Chainguard | azuredisk-csi-1.28-compat | 0 | 1.28.12-r11 |
| Chainguard | azuredisk-csi-1.29-compat | 0 | 1.29.14-r11 |
| Chainguard | azuredisk-csi-1.30-compat | 0 | 1.30.12-r9 |
| Chainguard | azuredisk-csi-1.31-compat | 0 | 1.31.12-r5 |
| Chainguard | azuredisk-csi-1.32 | 0 | 1.32.11-r6 |
| Chainguard | azuredisk-csi-1.33 | 0 | 1.33.7-r2 |
| Chainguard | azuredisk-csi-1.33-compat | 0 | 1.33.7-r2 |
| Chainguard | azuredisk-csi-fips-1.32 | 0 | 1.32.11-r6 |
| Chainguard | azuredisk-csi-fips-1.33 | 0 | 1.33.7-r2 |
| Chainguard | azurefile-csi-1.29-compat | 0 | 1.29.12-r9 |
| Chainguard | azurefile-csi-1.30-compat | 0 | 1.30.10-r9 |
| Chainguard | azurefile-csi-1.31-compat | 0 | 1.31.8-r5 |
| Chainguard | azurefile-csi-1.32 | 0 | 1.32.8-r3 |
| Chainguard | azurefile-csi-1.32-compat | 0 | 1.32.8-r3 |
| Chainguard | azurefile-csi-1.33 | 0 | 1.33.6-r4 |
| Chainguard | azurefile-csi-1.33-compat | 0 | 1.33.6-r4 |
| Chainguard | azurefile-csi-1.34 | 0 | 1.34.2-r2 |
| Chainguard | azurefile-csi-1.34-compat | 0 | 1.34.2-r2 |
| Chainguard | azurefile-csi-fips-1.29-compat | 0 | 1.29.12-r9 |
| Chainguard | azurefile-csi-fips-1.30-compat | 0 | 1.30.10-r9 |
| Chainguard | azurefile-csi-fips-1.31-compat | 0 | 1.31.8-r5 |
| Chainguard | azurefile-csi-fips-1.32 | 0 | 1.32.8-r3 |
| Chainguard | azurefile-csi-fips-1.33 | 0 | 1.33.6-r3 |
| Chainguard | azurefile-csi-fips-1.34 | 0 | 1.34.2-r2 |
| Chainguard | azurefile-csi-fips-1.34-compat | 0 | 1.34.2-r2 |
| Chainguard | blob-csi-1.23 | 0 | 1.23.11-r61 |
| Chainguard | blob-csi-1.23-compat | 0 | 1.23.11-r61 |
| Chainguard | blob-csi-1.24 | 0 | 1.24.11-r10 |
| Chainguard | blob-csi-1.24-compat | 0 | 1.24.11-r10 |
| Chainguard | blob-csi-1.25 | 0 | 1.25.10-r6 |
| Chainguard | blob-csi-1.25-compat | 0 | 1.25.10-r6 |
| Chainguard | blob-csi-1.26 | 0 | 1.26.7-r9 |
| Chainguard | blob-csi-1.26-compat | 0 | 1.26.7-r9 |
| Chainguard | blob-csi-1.27 | 0 | 1.27.0-r5 |
| Chainguard | blob-csi-1.27-compat | 0 | 1.27.0-r5 |
| Chainguard | blob-csi-fips-1.23 | 0 | 1.23.11-r62 |
| Chainguard | blob-csi-fips-1.23-compat | 0 | 1.23.11-r62 |
| Chainguard | blob-csi-fips-1.24 | 0 | 1.24.11-r10 |
| Chainguard | blob-csi-fips-1.24-compat | 0 | 1.24.11-r10 |
| Chainguard | blob-csi-fips-1.25 | 0 | 1.25.10-r5 |
| Chainguard | blob-csi-fips-1.25-compat | 0 | 1.25.10-r5 |
| Chainguard | blob-csi-fips-1.26 | 0 | 1.26.7-r8 |
| Chainguard | blob-csi-fips-1.26-compat | 0 | 1.26.7-r8 |
| Chainguard | blob-csi-fips-1.27 | 0 | 1.27.0-r4 |
| Chainguard | blob-csi-fips-1.27-compat | 0 | 1.27.0-r4 |
| Chainguard | calico-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-apiserver-3.30 | 0 | 3.30.5-r4 |
| Chainguard | calico-apiserver-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-apiserver-compat-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-apiserver-compat-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-app-policy-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-app-policy-3.30 | 0 | 3.30.5-r4 |
| Chainguard | calico-app-policy-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-app-policy-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-app-policy-fips-3.30 | 0 | 3.30.5-r4 |
| Chainguard | calico-app-policy-fips-3.31 | 0 | 3.31.2-r5 |
| Chainguard | calico-cni-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-cni-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-cni-compat-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-cni-compat-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-cni-compat-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-cni-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-felix-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-goldmane-3.30 | 0 | 3.30.5-r4 |
| Chainguard | calico-goldmane-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-goldmane-fips-3.31 | 0 | 3.31.2-r5 |
| Chainguard | calico-key-cert-provisioner-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-key-cert-provisioner-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-key-cert-provisioner-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-kube-controllers-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-kube-controllers-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-kube-controllers-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-node-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-pod2daemon-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-pod2daemon-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-pod2daemon-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-pod2daemon-flexvol-compat-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-pod2daemon-flexvol-compat-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-typha-client-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-typha-client-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-typha-client-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-typhad-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-typhad-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-typhad-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calico-whisker-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calico-whisker-backend-3.30 | 0 | 3.30.5-r4 |
| Chainguard | calico-whisker-backend-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calicoctl-3.29 | 0 | 3.29.7-r3 |
| Chainguard | calicoctl-3.31 | 0 | 3.31.3-r0 |
| Chainguard | calicoctl-fips-3.29 | 0 | 3.29.7-r3 |
| Chainguard | cephcsi | 0 | 3.15.1-r3 |
| Chainguard | cephcsi-compat | 0 | 3.15.1-r3 |
| Chainguard | cephcsi-fips | 0 | 3.15.1-r3 |
| Chainguard | cluster-autoscaler-1.31-compat | 0 | 1.31.5-r3 |
| Chainguard | cluster-autoscaler-fips-1.31 | 0 | 1.31.5-r4 |
| Chainguard | cluster-autoscaler-fips-1.31-compat | 0 | 1.31.5-r3 |
| Chainguard | docker-machine-driver-harvester | 0 | 1.0.5-r3 |
| Chainguard | eks-distro-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-1.30 | 0 | 1.30.49-r0 |
| Chainguard | eks-distro-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-coredns-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-coredns-1.30 | 0 | 1.30.49-r0 |
| Chainguard | eks-distro-coredns-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-coredns-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-coredns-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-coredns-fips-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-coredns-fips-1.30 | 0 | 1.30.49-r0 |
| Chainguard | eks-distro-coredns-fips-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-coredns-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-coredns-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-fips-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-fips-1.30 | 0 | 1.30.49-r0 |
| Chainguard | eks-distro-fips-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kube-apiserver-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kube-apiserver-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kube-apiserver-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kube-apiserver-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kube-controller-manager-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kube-controller-manager-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kube-controller-manager-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kube-proxy-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kube-proxy-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kube-proxy-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kube-proxy-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kube-scheduler-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kube-scheduler-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kube-scheduler-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kube-scheduler-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-attacher-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-provisioner-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-resizer-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshot-controller-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-external-snapshotter-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-livenessprobe-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-fips-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-csi-node-driver-registrar-fips-1.33 | 0 | 1.33.21-r0 |
| Chainguard | eks-distro-kubernetes-pause-1.29 | 0 | 1.29.56-r0 |
| Chainguard | eks-distro-kubernetes-pause-1.30 | 0 | 1.30.49-r0 |
| Chainguard | eks-distro-kubernetes-pause-1.31 | 0 | 1.31.38-r0 |
| Chainguard | eks-distro-kubernetes-pause-1.32 | 0 | 1.32.31-r0 |
| Chainguard | eks-distro-kubernetes-pause-1.33 | 0 | 1.33.21-r0 |
| Chainguard | emissary | 0 | 3.10.0-r15 |
Related vulnerabilities
- CVE-2024-10220 The Kubernetes kubelet component allows arbitrary command execution via specially crafted… Also affects k8s.io/kubernetes
- CVE-2024-5321 A security issue was discovered in Kubernetes clusters with Windows nodes where… Also affects k8s.io/kubernetes
- CVE-2024-3177 A security issue was discovered in Kubernetes where users may be able to launch… Also affects k8s.io/kubernetes
- CVE-2019-11253 Improper input validation in the Kubernetes API server in versions v1.0-1.12 and versions… Also affects k8s.io/kubernetes
- CVE-2025-68156 Expr is an expression language and expression evaluation for Go. Also affects argo-cd-2.13-repo-server
- CVE-2025-47907 Cancelling a query (e.g. Also affects argo-cd-2.13-repo-server
- CVE-2025-22871 The net/http package improperly accepts a bare LF as a line terminator in chunked data… Also affects argo-cd-2.13-repo-server
- CVE-2025-22870 Matching of hosts against proxy patterns can improperly treat an IPv6 zone ID as a… Also affects argo-cd-2.13-repo-server