CVE-2025-13281
MediumAdvisory
Published 15 Dec 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.8
- base score, highest
- EPSS
- 0.004
- 32nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 261
- of 17,781 indexed, latest versions
- Container images
- 239
- deployed by those charts
- Fix available
- 1 of 1
- affected package
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass
Carried by container images the latest versions of 261 of 17,781 indexed charts deploy, on 239 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| k8s.io/ | v0.0.0-20240417172702-7c48c2bd72b9, v0.0.0-20240514104202-6911225c3f74, v0.0.0-20240611201126-f25b321b9ae4, v0.0.0-20240611201706-062798d53d83+112 more | 1.32.10, 1.33.6, 1.34.2 | 239 |
- OSV records
- GHSA-r6j8-c6r2-37rr
- Also known as
- GO-2025-4240
Charts affected
261 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| tfy-inferentia-operatortruefoundryVerified publisher | 0.2.8 | 1 of 3See more | 2,902 |
| jupyterhubuninettsigma2 | 1.6.0 | 1 of 5See more | 8,607 |
| vineyard-operatorvineyardVerified publisher | 0.24.2 | 1 of 2See more | 4,525 |
| azure-scheduledevents-managerwebdevopsVerified publisher | 1.0.17 | 1 of 1See more | 1,122 |
| emissary-ingresswenerme | 8.12.2 | 1 of 2See more | 10,843 |
| longhornwenerme | 1.2.3 | 1 of 2See more | 15,230 |
| nfs-subdir-external-provisionerwenerme | 4.0.18 | 1 of 1See more | 2,743 |
| ceph-csi-cephfswikimedia | 0.1.8 | 1 of 5See more | 10,285 |
| ceph-csi-rbdwikimedia | 0.1.13 | 1 of 6See more | 11,784 |
| csi-driver-host-pathwiremindVerified publisher | 0.1.1 | 1 of 8See more | 12,606 |
| xkopsxkops | 0.1.0 | 1 of 5See more | 13,677 |
Container images carrying it
239 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| alpine/ | 6dbe6f391eda | k8s.io/ | 1.32.10 | 1 |
| alpine/ | 7a319b15cfc9 | k8s.io/ | 1.32.10 | 1 |
| alpine/ | 7e1e7d5b7a96 | k8s.io/ | 1.32.10 | 1 |
| alpine/ | 9c4976d47656 | k8s.io/ | 1.32.10 | 1 |
| alpine/ | bd01dae02676 | k8s.io/ | 1.32.10 | 1 |
| alpine/ | cd560fce90f7 | k8s.io/ | 1.32.10 | 1 |
| alpine/ | e5c0b053fed7 | k8s.io/ | 1.32.10 | 1 |
| alpine/ | eec354133193 | k8s.io/ | 1.32.10 | 1 |
| alpine/ | fc059f056ad0 | k8s.io/ | 1.32.10 | 1 |
| alpine/ | 2c59a3f0726c | k8s.io/ | 1.33.6 | 1 |
| amazon/ | b55277652ea8 | k8s.io/ | 1.32.10 | 1 |
| ambassador/ | 7a1ea0d934fb | k8s.io/ | 1.32.10 | 1 |
| apecloud/ | 5832d1a9097a | k8s.io/ | 1.32.10 | 1 |
| apecloud/ | 98abc64aa985 | k8s.io/ | 1.32.10 | 1 |
| apecloud/ | c93655ccb2d7 | k8s.io/ | 1.32.10 | 1 |
| berkeleyskypilot/ | 8da2f3cda472 | k8s.io/ | 1.33.6 | 1 |
| bitnamilegacy/ | 1249fc292e84 | k8s.io/ | 1.32.10 | 1 |
| bitnamilegacy/ | 64614ef8290f | k8s.io/ | 1.32.10 | 1 |
| bitnamilegacy/ | 744f84cf7493 | k8s.io/ | 1.32.10 | 1 |
| bitnamilegacy/ | f5fc0d561d9e | k8s.io/ | 1.32.10 | 1 |
| breton/ | 41b1bb483aa2 | k8s.io/ | 1.32.10 | 1 |
| burganbank/ | 9259c34e4037 | k8s.io/ | 1.32.10 | 1 |
| calico/ | 385bf6391fea | k8s.io/ | 1.32.10 | 1 |
| calico/ | d8c644a8a3ee | k8s.io/ | 1.32.10 | 1 |
| cgtysylr/ | aec0f8a38a77 | k8s.io/ | 1.32.10 | 1 |
| chriswells0/ | f3918ec8471c | k8s.io/ | 1.32.10 | 1 |
| crowdfox/ | 6fa7e8063d27 | k8s.io/ | 1.32.10 | 1 |
| csiplugin/ | 1fa83d45417f | k8s.io/ | 1.32.10 | 1 |
| datadog/ | 8f20e56b5311 | k8s.io/ | 1.32.10 | 1 |
| datawire/ | 95ec30b3c732 | k8s.io/ | 1.32.10 | 1 |
| datawire/ | 1f67a1292d2a | k8s.io/ | 1.32.10 | 1 |
| ddosify/ | ea602056d9ce | k8s.io/ | 1.32.10 | 1 |
| dongjiang1989/ | dc5bd483874c | k8s.io/ | 1.32.10 | 1 |
| dongjiang1989/ | 923085c65123 | k8s.io/ | 1.32.10 | 1 |
| dongjiang1989/ | f0055c05dbee | k8s.io/ | 1.32.10 | 1 |
| dserio83/ | 6b3d9115fee2 | k8s.io/ | 1.32.10 | 1 |
| dtzar/ | a1041bb0f1d1 | k8s.io/ | 1.32.10 | 1 |
| flanksource/ | 689687a7cf95 | k8s.io/ | 1.34.2 | 1 |
| flomesh/ | cc39c96711c4 | k8s.io/ | 1.32.10 | 1 |
| flomesh/ | 22f849c70b25 | k8s.io/ | 1.32.10 | 1 |
| gocrane/ | a1400909118c | k8s.io/ | 1.32.10 | 1 |
| gocrane/ | 9ba6d11b2079 | k8s.io/ | 1.32.10 | 1 |
| gocrane/ | a2d7e60576f9 | k8s.io/ | 1.32.10 | 1 |
| groundnuty/ | a26d3d3f6e1c | k8s.io/ | 1.32.10 | 1 |
| hammerspaceinc/ | 395bee4504fc | k8s.io/ | 1.33.6 | 1 |
| hetznercloud/ | 41dce5b33644 | k8s.io/ | 1.32.10 | 1 |
| huzafach/ | 6e271d43ea48 | k8s.io/ | 1.32.10 | 1 |
| inaccel/ | a5d3d0af05c1 | k8s.io/ | 1.32.10 | 1 |
| inseefrlab/ | 31f04ca7436b | k8s.io/ | 1.32.10 | 1 |
| j0113/ | 696cb8ca9f4e | k8s.io/ | 1.32.10 | 1 |