CVE-2025-13281 Portworx Half-Blind SSRF in kube-controller-manager
Authorized users can leak information from control plane host network endpoints via SSRF in kube-controller-manager when using in-tree Portworx StorageClass.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2025-13281?
CVE-2025-13281 is a medium-severity server-side request forgery vulnerability in Kubernetes, published on 14 Dec 2025. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
Weakness: CWE-918
Which versions are affected by CVE-2025-13281?
7 open source packages ship an affected version, including k8s.io/kubernetes.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | All versions | 1.32.10, 1.33.6, 1.34.2 |
k8s.io/kubernetes Go | All versions | 1.32.10 |
k8s.io/kubernetes Go | All versions | 1.32.10 |
k8s.io/kubernetes Go | From 1.33.0-alpha.0 | 1.33.6 |
k8s.io/kubernetes Go | From 1.33.0-alpha.0 | 1.33.6 |
k8s.io/kubernetes Go | From 1.34.0-alpha.0 | 1.34.2 |
1 more packages
k8s.io/kubernetes Go | From 1.34.0-alpha.0 | 1.34.2 |
How do I fix CVE-2025-13281?
Upgrade k8s.io/kubernetes to a fixed version for your release line: 1.32.10, 1.33.6 or 1.34.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2025-13281 being exploited?
There is no known exploitation of CVE-2025-13281 in the wild and no public exploit code.
Sources
Also known as AZL-72382, AZL-72386, CLEANSTART-2026-FK82448, CLEANSTART-2026-KO57202, DEBIAN-CVE-2025-13281, ECHO-d43d-bac8-84e2 and 42 more.