kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2025-13281 · ADVISORY
• kubernetes/kubernetes · WEB
• kubernetes/kubernetes commit 7506ce8 · WEB
• kubernetes/kubernetes commit 97650c1 · WEB
• kubernetes/kubernetes commit dbe17df · WEB
• GitHub Advisory GHSA-r6j8-c6r2-37rr · ADVISORY
• kubernetes/kubernetes · PACKAGE
• groups.google.com/g/kubernetes-security-announce/c/EORqZg0k1l4/m/TtD-q0v7AgAJ · WEB
• openwall.com/lists/oss-security/2025/12/01/4 · WEB

k8s.io/kubernetes のその他の脆弱性

• CVE-2025-5187中 6.7A vulnerability exists in the NodeRestriction admission controller in Kubernetes clusters where node users can delete their corresponding no…
• CVE-2025-4563低 2.7A vulnerability exists in the NodeRestriction admission controller where nodes can bypass dynamic resource allocation authorization checks. …
• CVE-2024-7598低 3.1A security issue was discovered in Kubernetes where a malicious or compromised pod could bypass network restrictions enforced by network pol…
• CVE-2025-1767中 6.5This CVE only affects Kubernetes clusters that utilize the in-tree gitRepo volume to clone git repositories from other pods within the same …
• CVE-2024-9042中 5.9This CVE affects only Windows worker nodes. Your worker node is vulnerable to this issue if it is running one of the affected versions liste…