CVE-2025-13281: kubernetes Server-Side Request Forgery (SSRF)

CVSS: 5.8v3.1MediumDeferred

AliasesDEBIAN-CVE-2025-13281CGA-27f5-wrm9-pgqqCGA-2g3w-mgxw-9hfg+729 more

Published 14-12-2025Last modified 15-12-2025

Vulnerability summary

CVE-2025-13281 is a medium (CVSS 5.8) Server-Side Request Forgery (SSRF) vulnerability in kubernetes. EPSS estimates a 0.39% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities.

Overall risk

23/100

0100

Low · default modelHow is this calculated?

CVSS score

5.8/10

010

Medium · v3.1 (CVE.org)

EPSS score

0.39%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedIn no KEV catalog

RansomwareNone recordedNo known use recorded

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 2 · Related 12

OPENSUSE-SU-2026:21483-1 SUSE-SU-2026:0037-1 CGA-3VVW-VCJV-PGJW CGA-5GHM-7QMM-GM2H CGA-623G-WC8M-2F4P CGA-CXV7-9R8W-7Q6J+6 more

Timeline

14-12-2025
PublishedVulnerability first disclosed.
15-12-2025
Last modifiedVulnerability information updated.

Description

A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).

CVSS metrics

6 scores · 6 sources · 1 version

v3.15.8

EPSS trend

Probability

0.39%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

0.00 pp

From 0.39% on 19-09-2026

19-09-202619-10-2026

EPSS score

0.39%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-918Server-Side Request Forgery (SSRF)The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Affected systems

Chainguard200 products

argo-cd-2.13All versions (No fix recorded)
argo-cd-2.13-compatAll versions (No fix recorded)
argo-cd-2.14All versions (No fix recorded)
argo-cd-2.14-compatAll versions (No fix recorded)
argo-cd-3.0< 3.0.20-r8

argo-cd-3.0-compat< 3.0.20-r8
argo-cd-3.0-iamguarded-compat< 3.0.20-r8
argo-cd-3.0-repo-server< 3.0.20-r8
argo-cd-3.1< 3.1.9-r7
argo-cd-3.1-compat< 3.1.9-r7
argo-cd-3.1-iamguarded-compat< 3.1.9-r7
argo-cd-3.1-repo-server< 3.1.9-r7
argo-cd-3.2< 3.2.2-r0 | < 3.2.1-r4
argo-cd-3.2-compat< 3.2.1-r4
argo-cd-3.2-iamguarded-compat< 3.2.1-r4
argo-cd-3.2-repo-server< 3.2.1-r4
argo-cd-fips-2.14All versions (No fix recorded)
argo-cd-fips-2.14-compatAll versions (No fix recorded)
argo-cd-fips-3.0< 3.0.20-r9
argo-cd-fips-3.0-compat< 3.0.20-r9
argo-cd-fips-3.1< 3.1.9-r10 | < 3.1.9-r9
argo-cd-fips-3.1-compat< 3.1.9-r9
argo-cd-fips-3.1-iamguarded-compat< 3.1.9-r9
argo-cd-fips-3.1-repo-server< 3.1.9-r9
argo-cd-fips-3.2-compat< 3.2.1-r3
argo-rollouts< 1.10.0-r0
argo-rollouts-fips< 1.10.0-r0
argocd-image-updater< 1.0.2-r1
argocd-image-updater-compat< 1.0.2-r1
argocd-image-updater-fips< 1.0.2-r1
aws-efs-csi-driver< 2.2.0-r1
aws-efs-csi-driver-fips< 2.2.0-r1
azuredisk-csi-1.28All versions (No fix recorded)
azuredisk-csi-1.29All versions (No fix recorded)
azuredisk-csi-1.30All versions (No fix recorded)
azuredisk-csi-1.31All versions (No fix recorded)
azuredisk-csi-1.32< 1.32.11-r6
azuredisk-csi-1.33< 1.33.7-r2
azuredisk-csi-1.33-compat< 1.33.7-r2
azuredisk-csi-fips-1.28All versions (No fix recorded)
azuredisk-csi-fips-1.29All versions (No fix recorded)
azuredisk-csi-fips-1.30All versions (No fix recorded)
azuredisk-csi-fips-1.31All versions (No fix recorded)
azuredisk-csi-fips-1.32< 1.32.11-r6
azuredisk-csi-fips-1.33< 1.33.7-r2
azurefile-csi-1.29All versions (No fix recorded)
azurefile-csi-1.30All versions (No fix recorded)
azurefile-csi-1.31All versions (No fix recorded)
azurefile-csi-1.32< 1.32.8-r3
azurefile-csi-1.33< 1.33.6-r4
azurefile-csi-1.33-compat< 1.33.6-r4
azurefile-csi-1.34< 1.34.2-r2
azurefile-csi-1.34-compat< 1.34.2-r2
azurefile-csi-fips-1.29All versions (No fix recorded)
azurefile-csi-fips-1.30All versions (No fix recorded)
azurefile-csi-fips-1.31All versions (No fix recorded)
azurefile-csi-fips-1.32< 1.32.8-r3
azurefile-csi-fips-1.33< 1.33.6-r3
azurefile-csi-fips-1.34< 1.34.2-r2
azurefile-csi-fips-1.34-compat< 1.34.2-r2
blob-csi-1.23< 1.23.11-r61
blob-csi-1.23-compat< 1.23.11-r61
blob-csi-1.24< 1.24.11-r10
blob-csi-1.24-compat< 1.24.11-r10
blob-csi-1.25< 1.25.10-r6
blob-csi-1.25-compat< 1.25.10-r6
blob-csi-1.26< 1.26.7-r9
blob-csi-1.26-compat< 1.26.7-r9
blob-csi-1.27< 1.27.0-r5
blob-csi-fips-1.23< 1.23.11-r62
blob-csi-fips-1.23-compat< 1.23.11-r62
blob-csi-fips-1.24< 1.24.11-r10
blob-csi-fips-1.24-compat< 1.24.11-r10
blob-csi-fips-1.25< 1.25.10-r5
blob-csi-fips-1.25-compat< 1.25.10-r5
blob-csi-fips-1.26< 1.26.7-r8
blob-csi-fips-1.26-compat< 1.26.7-r8
blob-csi-fips-1.27< 1.27.0-r4
blob-csi-fips-1.27-compat< 1.27.0-r4
calico-3.31< 3.31.3-r0
calico-apiserver-3.29All versions (No fix recorded)
calico-apiserver-3.30< 3.30.5-r4
calico-apiserver-3.31< 3.31.3-r0
calico-apiserver-compat-3.31< 3.31.3-r0
calico-apiserver-fips-3.29All versions (No fix recorded)
calico-app-policy-3.30< 3.30.5-r4
calico-app-policy-3.31< 3.31.3-r0
calico-app-policy-fips-3.30< 3.30.5-r4
calico-app-policy-fips-3.31< 3.31.2-r5
calico-cni-3.31< 3.31.3-r0
calico-cni-compat-3.31< 3.31.3-r0
calico-felix-3.29All versions (No fix recorded)
calico-felix-3.31< 3.31.3-r0
calico-felix-fips-3.29All versions (No fix recorded)
calico-goldmane-3.30< 3.30.5-r4
calico-goldmane-3.31< 3.31.3-r0
calico-goldmane-fips-3.31< 3.31.2-r5
calico-key-cert-provisioner-3.31< 3.31.3-r0
calico-kube-controllers-3.31< 3.31.3-r0
calico-node-3.29All versions (No fix recorded)
calico-node-3.31< 3.31.3-r0
calico-node-fips-3.29All versions (No fix recorded)
calico-pod2daemon-3.31< 3.31.3-r0
calico-pod2daemon-flexvol-compat-3.31< 3.31.3-r0
calico-typha-client-3.31< 3.31.3-r0
calico-typhad-3.31< 3.31.3-r0
calico-whisker-3.31< 3.31.3-r0
calico-whisker-backend-3.30< 3.30.5-r4
calico-whisker-backend-3.31< 3.31.3-r0
calicoctl-3.31< 3.31.3-r0
cephcsi< 3.15.1-r3
cephcsi-fips< 3.15.1-r3
cluster-autoscaler-1.31All versions (No fix recorded)
cluster-autoscaler-fips-1.31All versions (No fix recorded)
docker-machine-driver-harvester< 1.0.6-r4
eks-distro-1.32< 1.32.31-r0
eks-distro-1.33< 1.33.21-r0
eks-distro-coredns-1.32< 1.32.31-r0
eks-distro-coredns-1.33< 1.33.21-r0
eks-distro-coredns-fips-1.32< 1.32.31-r0
eks-distro-coredns-fips-1.33< 1.33.21-r0
eks-distro-fips-1.32< 1.32.31-r0
eks-distro-fips-1.33< 1.33.21-r0
eks-distro-kube-apiserver-1.29All versions (No fix recorded)
eks-distro-kube-apiserver-1.30All versions (No fix recorded)
eks-distro-kube-apiserver-1.31All versions (No fix recorded)
eks-distro-kube-apiserver-1.32< 1.32.31-r0
eks-distro-kube-apiserver-1.33< 1.33.21-r0
eks-distro-kube-apiserver-fips-1.29All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.30All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.31All versions (No fix recorded)
eks-distro-kube-apiserver-fips-1.32< 1.32.31-r0
eks-distro-kube-apiserver-fips-1.33< 1.33.21-r0
eks-distro-kube-controller-manager-1.29All versions (No fix recorded)
eks-distro-kube-controller-manager-1.30All versions (No fix recorded)
eks-distro-kube-controller-manager-1.31All versions (No fix recorded)
eks-distro-kube-controller-manager-1.32< 1.32.31-r0
eks-distro-kube-controller-manager-1.33< 1.33.21-r0
eks-distro-kube-controller-manager-fips-1.29All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.30All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.31All versions (No fix recorded)
eks-distro-kube-controller-manager-fips-1.32< 1.32.31-r0
eks-distro-kube-controller-manager-fips-1.33< 1.33.21-r0
eks-distro-kube-proxy-1.29All versions (No fix recorded)
eks-distro-kube-proxy-1.30All versions (No fix recorded)
eks-distro-kube-proxy-1.31All versions (No fix recorded)
eks-distro-kube-proxy-1.32< 1.32.31-r0
eks-distro-kube-proxy-1.33< 1.33.21-r0
eks-distro-kube-proxy-fips-1.29All versions (No fix recorded)
eks-distro-kube-proxy-fips-1.30All versions (No fix recorded)
eks-distro-kube-proxy-fips-1.31All versions (No fix recorded)
eks-distro-kube-proxy-fips-1.32< 1.32.31-r0
eks-distro-kube-proxy-fips-1.33< 1.33.21-r0
eks-distro-kube-scheduler-1.29All versions (No fix recorded)
eks-distro-kube-scheduler-1.30All versions (No fix recorded)
eks-distro-kube-scheduler-1.31All versions (No fix recorded)
eks-distro-kube-scheduler-1.32< 1.32.31-r0
eks-distro-kube-scheduler-1.33< 1.33.21-r0
eks-distro-kube-scheduler-fips-1.29All versions (No fix recorded)
eks-distro-kube-scheduler-fips-1.30All versions (No fix recorded)
eks-distro-kube-scheduler-fips-1.31All versions (No fix recorded)
eks-distro-kube-scheduler-fips-1.32< 1.32.31-r0
eks-distro-kube-scheduler-fips-1.33< 1.33.21-r0
eks-distro-kubernetes-pause-1.32< 1.32.31-r0
eks-distro-kubernetes-pause-1.33< 1.33.21-r0
emissary< 3.10.0-r15
emissary-apiext< 3.10.0-r15
emissary-oci-entrypoint< 3.10.0-r15
ip-masq-agent< 2.12.0-r16
kapp< 0.65.0-r2
kapp-fips< 0.65.0-r2
kots< 1.129.1-r2
kube-apiserver-1.31All versions (No fix recorded)
kube-apiserver-1.32< 1.32.11-r0
kube-apiserver-1.32-default< 1.32.11-r0
kube-apiserver-1.32-default-compat< 1.32.11-r0
kube-apiserver-fips-1.31All versions (No fix recorded)
kube-conformance-1.31All versions (No fix recorded)
kube-controller-manager-1.31All versions (No fix recorded)
kube-controller-manager-1.32< 1.32.11-r0
kube-controller-manager-1.32-default< 1.32.11-r0
kube-controller-manager-1.32-default-compat< 1.32.11-r0
kube-controller-manager-fips-1.31All versions (No fix recorded)
kube-proxy-1.31All versions (No fix recorded)
kube-proxy-1.32< 1.32.11-r0
kube-proxy-1.32-default< 1.32.11-r0
kube-proxy-1.32-default-compat< 1.32.11-r0
kube-proxy-fips-1.31All versions (No fix recorded)
kube-scheduler-1.31All versions (No fix recorded)
kube-scheduler-1.32< 1.32.11-r0
kube-scheduler-1.32-default< 1.32.11-r0
kube-scheduler-1.32-default-compat< 1.32.11-r0
kube-scheduler-fips-1.31All versions (No fix recorded)
kubeadm-1.31All versions (No fix recorded)
kubeadm-1.32< 1.32.11-r0
kubeadm-1.32-default< 1.32.11-r0
kubeadm-1.32-default-compat< 1.32.11-r0
kubeadm-fips-1.31All versions (No fix recorded)
kubectl-1.30All versions (No fix recorded)
kubectl-1.31All versions (No fix recorded)

Show all 200

1 vendor · 200 products · Showing 200 of 362. Use Open JSON for the complete list.

References

11 links

Show all 11 references

github.com/kubernetes/kubernetesPACKAGE

Vulnerability summary

Advisory lineage

Timeline

Description

CVSS metrics

EPSS trend

Known exploited

Public exploits

Weaknesses

Affected systems

References

Related vulnerabilities