Description
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | v1.30.0 – ≤ v1.30.14, v1.31.0 – ≤ v1.31.14, v1.32.0 – ≤ v1.32.9, v1.33.0 – ≤ v1.33.5, v1.34.0 – ≤ v1.34.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 13 | kubernetes | 1.20.5+really1.20.2-1 | — |
| Debian 12 | kubernetes | 1.20.5+really1.20.2-1 | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 16.0 | govulncheck-vulndb | 0.0.20260723T184607-160000.1.1 | openSUSE-SU-2026:21483-1 |
| openSUSE Leap 15.6 | govulncheck-vulndb | 0.0.20251230T014957-150000.1.134.1 | SUSE-SU-2026:0037-1 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubernetes | 1.30.10-18 | — |
| Azure Linux 2 (CBL-Mariner) | kubernetes | 1.28.4-21 | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | argo-cd-3.2 +2 | 3.2.1-r4 | — |
| Wolfi rolling | argo-rollouts +1 | 1.10.0-r0 | — |
| Wolfi rolling | argocd-image-updater +1 | 1.0.2-r1 | — |
| Wolfi rolling | aws-efs-csi-driver | 2.2.0-r1 | — |
| Wolfi rolling | blob-csi-1.27 | 1.27.0-r5 | — |
| Wolfi rolling | calico-3.31 +17 | 3.31.3-r0 | — |
| Wolfi rolling | docker-machine-driver-harvester | 1.0.6-r4 | — |
| Wolfi rolling | emissary +4 | 3.10.0-r15 | — |
| Wolfi rolling | ip-masq-agent | 2.12.0-r16 | — |
| Wolfi rolling | kapp | 0.65.0-r2 | — |
| Wolfi rolling | kots | 1.129.1-r2 | — |
| Wolfi rolling | kubectl-1.30 +1 | No fix yet | — |
| Wolfi rolling | kubectl-1.32 +1 | 1.32.11-r0 | — |
| Wolfi rolling | kubernetes-csi-driver-hostpath | 1.17.0-r8 | — |
| Wolfi rolling | kubernetes-csi-driver-nfs | 4.13.0-r0 | — |
| Wolfi rolling | kubernetes-dns-node-cache | 1.26.7-r4 | — |
| Wolfi rolling | local-static-provisioner +1 | 2.9.0-r0 | — |
| Wolfi rolling | local-volume-node-cleanup-compat | 2.9.0-r4 | — |
| Wolfi rolling | mesosphere-vsphere-csi +2 | 3.5.0-r6 | — |
| Wolfi rolling | node-feature-discovery-0.18 | 0.18.3-r4 | — |
| Wolfi rolling | nodetaint | 0.0.5-r0 | — |
| Wolfi rolling | rancher-2.13 | 2.13.0-r1 | — |
| Wolfi rolling | rancher-agent-2.13 | 2.13.0-r2 | — |
| Wolfi rolling | rancher-system-agent | 0.3.14-r3 | — |
| Wolfi rolling | vcluster +1 | 0.30.3-r1 | — |
| Wolfi rolling | yunikorn-k8shim | 1.7.0-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | < 1.32.10 | 1.32.10 | GHSA-r6j8-c6r2-37rr |
| Go | k8s.io/kubernetes | >= 1.33.0-alpha.0, < 1.33.6 | 1.33.6 | GHSA-r6j8-c6r2-37rr |
| Go | k8s.io/kubernetes | >= 1.34.0-alpha.0, < 1.34.2 | 1.34.2 | GHSA-r6j8-c6r2-37rr |
| Go | k8s.io/kubernetes | < 1.32.10 · >= 1.33.0-alpha.0, < 1.33.6 · >= 1.34.0-alpha.0, < 1.34.2 | 1.32.10, 1.33.6, 1.34.2 | GO-2025-4240 |
Advisories 3
- openSUSE-SU-2026:21483-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Jul 31, 2026
- SUSE-SU-2026:0037-1 Security update for govulncheck-vulndb SUSE / openSUSE Security Updates · Mar 23, 2026
- WID-SEC-2025-2705 Kubernetes: Schwachstelle ermöglicht Offenlegung von Informationen BSI CERT-Bund (WID) · Dec 14, 2025