CVE-2025-13281
MediumAdvisory
Published 15 Dec 2025In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.8
- base score, highest
- EPSS
- 0.004
- 32nd percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 261
- of 17,781 indexed, latest versions
- Container images
- 239
- deployed by those charts
- Fix available
- 1 of 1
- affected package
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass
Carried by container images the latest versions of 261 of 17,781 indexed charts deploy, on 239 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| k8s.io/ | v0.0.0-20240417172702-7c48c2bd72b9, v0.0.0-20240514104202-6911225c3f74, v0.0.0-20240611201126-f25b321b9ae4, v0.0.0-20240611201706-062798d53d83+112 more | 1.32.10, 1.33.6, 1.34.2 | 239 |
- OSV records
- GHSA-r6j8-c6r2-37rr
- Also known as
- GO-2025-4240
Charts affected
261 by stars
| Chart | Latest | Affected images | Radar Score |
|---|---|---|---|
| tfy-inferentia-operatortruefoundryVerified publisher | 0.2.8 | 1 of 3See more | 2,902 |
| jupyterhubuninettsigma2 | 1.6.0 | 1 of 5See more | 8,607 |
| vineyard-operatorvineyardVerified publisher | 0.24.2 | 1 of 2See more | 4,525 |
| azure-scheduledevents-managerwebdevopsVerified publisher | 1.0.17 | 1 of 1See more | 1,122 |
| emissary-ingresswenerme | 8.12.2 | 1 of 2See more | 10,843 |
| longhornwenerme | 1.2.3 | 1 of 2See more | 15,230 |
| nfs-subdir-external-provisionerwenerme | 4.0.18 | 1 of 1See more | 2,743 |
| ceph-csi-cephfswikimedia | 0.1.8 | 1 of 5See more | 10,285 |
| ceph-csi-rbdwikimedia | 0.1.13 | 1 of 6See more | 11,784 |
| csi-driver-host-pathwiremindVerified publisher | 0.1.1 | 1 of 8See more | 12,606 |
| xkopsxkops | 0.1.0 | 1 of 5See more | 13,677 |
Container images carrying it
239 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| kong/ | 03510967482b | k8s.io/ | 1.33.6 | 1 |
| kubeedge/ | 460c6061b608 | k8s.io/ | 1.32.10 | 1 |
| kubeovn/ | 6722b54eb5c0 | k8s.io/ | 1.32.10 | 1 |
| kubesphere/ | 49b445b1b732 | k8s.io/ | 1.32.10 | 1 |
| kubevirtmanager/ | df3ea27d4a9e | k8s.io/ | 1.32.10 | 1 |
| kusionstack/ | b707d3bf0abd | k8s.io/ | 1.32.10 | 1 |
| kusionstack/ | d2f72ae1d2f2 | k8s.io/ | 1.32.10 | 1 |
| kusionstack/ | c28bd96b986b | k8s.io/ | 1.32.10 | 1 |
| leonardomulticloud/ | d119918900e8 | k8s.io/ | 1.32.10 | 1 |
| longhornio/ | 5b0bc1b88f0c | k8s.io/ | 1.34.2 | 1 |
| longhornio/ | dca34321452c | k8s.io/ | 1.32.10 | 1 |
| longhornio/ | ede61fe2a472 | k8s.io/ | 1.32.10 | 1 |
| longhornio/ | 9f6e5e3be8ab | k8s.io/ | 1.34.2 | 1 |
| mesosphere/ | 63bc411b930b | k8s.io/ | 1.32.10 | 1 |
| mesosphere/ | b036785a8862 | k8s.io/ | 1.32.10 | 1 |
| mesosphere/ | 94af41b6dd9a | k8s.io/ | 1.32.10 | 1 |
| mikejoh/ | 5c5a3b734271 | k8s.io/ | 1.32.10 | 1 |
| murtazashah46/ | 4d11726cf803 | k8s.io/ | 1.32.10 | 1 |
| natsio/ | 1261dae38389 | k8s.io/ | 1.32.10 | 1 |
| newrelic/ | 1a448492b55a | k8s.io/ | 1.34.2 | 1 |
| opencsghq/ | b6d87e1048c2 | k8s.io/ | 1.33.6 | 1 |
| openebs/ | 4f41dd782761 | k8s.io/ | 1.32.10 | 1 |
| openkruise/ | 0482722b4e56 | k8s.io/ | 1.32.10 | 1 |
| openpolicyagent/ | 77bc9bf3d163 | k8s.io/ | 1.32.10 | 1 |
| phntom/ | 3adadbac8443 | k8s.io/ | 1.32.10 | 1 |
| pnnlmiscscripts/ | 155131891741 | k8s.io/ | 1.32.10 | 1 |
| portainer/ | 3e61aaee1341 | k8s.io/ | 1.32.10 | 1 |
| rancher/ | 6d2cd61a338b | k8s.io/ | 1.32.10 | 1 |
| rancher/ | c678c25d47c8 | k8s.io/ | 1.32.10 | 1 |
| rancher/ | 8eb8092f0728 | k8s.io/ | 1.32.10 | 1 |
| rancher/ | f9099b5ef8cb | k8s.io/ | 1.34.2 | 1 |
| rancher/ | 85a0d1148784 | k8s.io/ | 1.32.10 | 1 |
| ryuunosukeds3/ | 0879f7261b10 | k8s.io/ | 1.32.10 | 1 |
| sealio/ | b0389d9848a5 | k8s.io/ | 1.32.10 | 1 |
| shlomibendavid/ | a22ffbe0f04e | k8s.io/ | 1.32.10 | 1 |
| sikalabs/ | 7bd267f30247 | k8s.io/ | 1.32.10 | 1 |
| veecode/ | c69fd286b489 | k8s.io/ | 1.32.10 | 1 |
| vineyardcloudnative/ | 9d419aa18faa | k8s.io/ | 1.32.10 | 1 |
| webdevops/ | 7acd46a8a972 | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | a4011eae6a0b | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | 5a0884f9a90c | k8s.io/ | 1.33.6 | 1 |
| gcr.io/ | 2b1a3d08caac | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | a348db3e4d74 | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | 39661bd823e8 | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | dc6ca05bb94f | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | 293941ee4f65 | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | 83e79c709df3 | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | 00db9796a37b | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | 109ac1b38c41 | k8s.io/ | 1.32.10 | 1 |
| gcr.io/ | 795a0c8a0e13 | k8s.io/ | 1.32.10 | 1 |