Vulnerability Report: GO-2025-4240
- CVE-2025-13281, GHSA-r6j8-c6r2-37rr
- Affects: k8s.io/kubernetes
- Published: Dec 16, 2025
Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes
For detailed information about this vulnerability, visit https://github.com/advisories/GHSA-r6j8-c6r2-37rr.
Affected Modules
-
PathGo Versions
-
before v1.32.10, from v1.33.0-alpha.0 before v1.33.6, from v1.34.0-alpha.0 before v1.34.2
Aliases
References
- https://github.com/advisories/GHSA-r6j8-c6r2-37rr
- http://www.openwall.com/lists/oss-security/2025/12/01/4
- https://github.com/kubernetes/kubernetes/commit/7506ce804c20696ba32cdb72126270ceaed06e24
- https://github.com/kubernetes/kubernetes/commit/97650c1c4fe15cbb7756ba95b3edc8a8665063ca
- https://github.com/kubernetes/kubernetes/commit/dbe17dfe7773563eac95534040f413ada6d2b421
- https://github.com/kubernetes/kubernetes/issues/135525
- https://groups.google.com/g/kubernetes-security-announce/c/EORqZg0k1l4/m/TtD-q0v7AgAJ
- https://vuln.go.dev/ID/GO-2025-4240.json
Feedback
See anything missing or incorrect?
Suggest an edit to this report.