PT-2025-49178 · Unknown+2 · Kube-Controller-Manager+2

Published 2025-12-04 · Updated 2026-05-21 · CVE-2025-13281

Positive Technologies (AI Summary)

CVSS v3.1

5.8

Medium

Base vector

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions kube-controller-manager (affected versions not specified)

Description An issue exists in kube-controller-manager when utilizing the in-tree Portworx StorageClass, allowing authorized users to potentially leak information from unprotected endpoints within the control plane’s host network. This includes link-local and loopback services. The issue is a half-blind Server Side Request Forgery (SSRF).

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

SSRF

Weakness Enumeration

CWE-918

Related Identifiers

AZL-72382

AZL-72386

BDU:2026-03571

CLEANSTART-2026-VI42371

CLEANSTART-2026-VJ54611

CVE-2025-13281

GHSA-R6J8-C6R2-37RR

GO-2025-4240

SUSE-SU-2026:0037-1

Affected Products

Portworx Storageclass

Red Os

Kube-Controller-Manager

References · 178

• https://nvd.nist.gov/vuln/detail/CVE-2025-13281 · Security Note
• https://osv.dev/vulnerability/GO-2025-4240 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-13281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-5187 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-32934 · Security Note
• https://osv.dev/vulnerability/SUSE-SU-2026:0037-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-13281 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-39836 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-58063 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-25679 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33190 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2025-64702 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-27139 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-39825 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-33186 · Security Note