CLEANSTART-2026-GY44839: half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass

Q: What access does an attacker need to exploit this issue?

The listed vector requires network access and high privileges. No user interaction is required, and exploitation is rated as high complexity.

Q: What is the expected security impact?

The vulnerability is rated as having high confidentiality impact, with no integrity or availability impact listed. Its scope is marked as changed.

Q: Which configuration is identified as affected?

The vulnerability is described as occurring in kube-controller-manager when the in-tree Portworx StorageClass is used. The provided data does not state whether other StorageClass configurations are affected.

Published Nov 5, 2026

Updated

Security vulnerability affects the nfs-subdir-external-provisioner package. A half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass.

Affected Software

1 affected componentFixes available

cleanstart/nfs-subdir-external-provisioner<4.0.2-r4

4.0.2-r4

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade cleanstart/nfs-subdir-external-provisioner to a version that resolves this vulnerability.
Fixed in 4.0.2-r4

Event History

Nov 5, 2026

Advisory Published

via OSV·08:10 AM

Data Sourced

via OSV·08:10 AM

DescriptionSeverityAffected Software

Child vulnerabilities

Contains the following vulnerabilities.

CVE-2025-13281

Frequently Asked Questions

What access does an attacker need to exploit this issue?

The listed vector requires network access and high privileges. No user interaction is required, and exploitation is rated as high complexity.

What is the expected security impact?

The vulnerability is rated as having high confidentiality impact, with no integrity or availability impact listed. Its scope is marked as changed.

Which configuration is identified as affected?

The vulnerability is described as occurring in kube-controller-manager when the in-tree Portworx StorageClass is used. The provided data does not state whether other StorageClass configurations are affected.

CLEANSTART-2026-GY44839: half-blind Server Side Request Forgery (SSRF) vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass

Affected Software

Remediation

Event History

Child vulnerabilities

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected security impact?

Which configuration is identified as affected?

Company

Resources

Contact

Frequently Asked Questions

What access does an attacker need to exploit this issue?

What is the expected security impact?

Which configuration is identified as affected?