oss-security - [kubernetes] CVE-2025-13281: Portworx Half-Blind SSRF in kube-controller-manager

Follow @Openwall on Twitter for new release announcements and other news

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CABrZYSAD=-L5Gyqj4mY+vcAt_Cu=hevmbB0JGqsmdxMqszBYbA@mail.gmail.com>
Date: Mon, 1 Dec 2025 09:24:00 -0800
From: Nathan Herz <nathan.herz97@...il.com>
To: oss-security@...ts.openwall.com
Subject: [kubernetes] CVE-2025-13281: Portworx Half-Blind SSRF in kube-controller-manager

Hello Kubernetes Community,

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in
kube-controller-manager when using the in-tree Portworx StorageClass. This
vulnerability allows authorized users to leak arbitrary information from
unprotected endpoints in the control plane’s host network (including
link-local or loopback services).

The in-tree Portworx StorageClass has been disabled by default starting in
version v1.31 from the CSIMigrationPortworx feature gate. As a result,
currently supported versions greater than or equal to v1.32 are not
impacted unless the CSIMigrationPortworx feature gate is disabled with an
override.

This issue has been rated Medium (5.8)
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N
<https://www.first.org/cvss/calculator/3-1#CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N>,
and assigned CVE-2025-13281.

Am I vulnerable?

You may be vulnerable if all of the following are true:

   -

   You are running a vulnerable version and have manually disabled the
CSIMigrationPortworx
   feature gate.
   -

   There are unprotected endpoints normally only visible from the control
   plane’s host network (including link-local metadata endpoints,
   unauthenticated services listening on localhost, or other services in the
   control plane’s private network).
   -

   Untrusted users can create pods with the affected Portworx volume type.

Affected Versions

The CSIMigrationPortworx feature gate was enabled by default starting on
version v1.31. As a result, EOL versions <= v1.30 are more likely to be
vulnerable because the CSIMigrationPortworx feature is disabled by default.

   -

   kube-controller-manager: <= v1.30.14
   -

   kube-controller-manager: <= v1.31.14
   -

   kube-controller-manager: <= v1.32.9
   -

   kube-controller-manager: <= v1.33.5
   -

   kube-controller-manager: <= v1.34.1

How do I mitigate this vulnerability?

This issue can be mitigated by upgrading to a fixed kube-controller-manager
version or by enabling the CSIMigrationPortworx feature gate (if it was
overridden from its default value in versions greater than equal to v1.31).

Fixed Versions

   -

   kube-controller-manager: >= v1.32.10
   -

   kube-controller-manager: >= v1.33.6
   -

   kube-controller-manager: >= v1.34.2

Detection

This issue can be detected on clusters which have the CSIMigrationPortworx
feature gate disabled on impacted versions by analyzing ProvisioningFailed
events from kube-controller-manager which may contain sensitive information
from the control plane’s host network.

If you find evidence that this vulnerability has been exploited, please
contact security@...ernetes.io

Additional Details

See the GitHub issue for more details:
https://github.com/kubernetes/kubernetes/issues/135525

Acknowledgements

The issue was fixed and coordinated by:

Ankit Gohil @gohilankit

Thank You,

Nathan Herz on behalf of the Kubernetes Security Response Committee

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.