Description (CNA)
A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network (including link-local or loopback services).
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Kubernetes / Kubernetes | affected v1.30.0 through v1.30.14; affected v1.31.0 through v1.31.14; affected v1.32.0 through v1.32.9; affected v1.33.0 through v1.33.5; affected v1.34.0 through v1.34.1 |
CWE
CWE-918
References
- https://github.com/kubernetes/kubernetes/issues/135525
- https://groups.google.com/g/kubernetes-security-announce/c/EORqZg0k1l4/m/TtD-q0v7AgAJ
ADP enrichment
No English description supplied.
No English description supplied.
No references supplied.