Half-Blind SSRF Vulnerability in Kubernetes Package
Summary
DEBIAN-CVE-2025-13281: A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. Affects kubernetes versions < 1.20.5+really1.20.2-1. Fixed in 1.20.5+really1.20.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kubernetes is an open-source platform designed to automate deploying, scaling, and operating application containers. It provides a robust framework for managing containerized applications across a cluster of machines. The package is widely used in cloud-native environments and supports various storage solutions, including the in-tree Portworx StorageClass. However, it is susceptible to a half-blind Server Side Request Forgery (SSRF) vulnerability that can expose sensitive information.
Vulnerability Detail
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in the kube-controller-manager when utilizing the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints within the control plane's host network, including access to link-local or loopback services. The issue arises from improper validation of requests, which can be exploited by attackers to gain unauthorized access to sensitive data.
How To Fix
Minimum fixed version
1.20.5+really1.20.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade kubernetesTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, consider restricting access to the kube-controller-manager and ensuring that sensitive endpoints are adequately protected. Implement network policies to limit access to the control plane's host network.
Conclusion
The half-blind SSRF vulnerability in the Kubernetes package poses a significant risk to authorized users, allowing potential information leakage from the control plane's host network. It is crucial to update to the patched version to mitigate this risk and ensure the security of your applications.
See every vulnerability recorded for kubernetes →
FAQ
SSRF is a type of security vulnerability that allows an attacker to send crafted requests from a vulnerable server to internal or external resources, potentially exposing sensitive data.
Authorized users of the Kubernetes package utilizing the in-tree Portworx StorageClass are at risk of this vulnerability.
Exploitation of this vulnerability can lead to unauthorized information disclosure from unprotected endpoints within the control plane's host network.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without requiring any signup.
The CVSS score for this vulnerability is 5.8, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for kubernetes.
