35 matches found
CVE-2026-15140
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...
EUVD-2026-74894
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...
CVE-2026-15140
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...
CVE-2026-15140
CVE-2026-15140 is a privilege-escalation vulnerability in the Portworx Operator when deployed on Red Hat OpenShift (OCP) . During the initial provisioning of a Portworx storage cluster, under specific conditions, a user with only namespace-scoped permissions can cause the operator to grant broade...
CVE-2026-15140
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...
PT-2026-88964
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...
CVE-2026-15140: Incorrect Privilege Assignment
A privilege-escalation issue in the Portworx Operator when deployed on Red Hat OpenShift OCP. Only under specific conditions during the initial provisioning of a Portworx storage cluster, a user holding only limited, namespace-scoped permissions could cause the operator to grant broader access th...
Security Bulletin: IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery (SSRF) vulnerability in kubernetes [CVE-2025-13281]
Summary IBM Watson Speech Services Cartridge is vulnerable to a Server Side Request Forgery SSRF vulnerability in kubernetes, due to an issue in kube-controller-manager when using the in-tree Portworx StorageClass CVE-2025-13281. Kubernetes is used as part of our speech utilities. This...
Unity Linux 20.1050e / 20.1070e Security Update: kubernetes (UTSA-2026-017342)
The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-017342 advisory. A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows...
Server-Side Request Forgery (SSRF)
kube-controller-manager is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper validation of requests in the in-tree Portworx StorageClass, which allows an attacker to leak sensitive information from internal or unprotected endpoints within the control plane’s hos...
OESA-2026-1162 kubernetes security update
Container cluster management. Security Fixes: A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the...
GO-2025-4240 Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes
Half-blind Server Side Request Forgery in kube-controller-manager through in-tree Portworx StorageClass in k8s.io/kubernetes...
Portworx Half-Blind SSRF in kube-controller-manager
...
CVE-2025-13281
A half-blind Server-Side Request Forgery SSRF found in kube-controller-manager that can be triggered when using the legacy in-tree Portworx StorageClass. An authorized user with sufficient privileges can cause the controller to make requests to internal, host-network–accessible endpoints,...
kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
EUVD-2025-203310
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
GHSA-R6J8-C6R2-37RR kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
AZL-72382 CVE-2025-13281 affecting package kubernetes for versions less than 1.30.10-18
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
DEBIAN-CVE-2025-13281
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...
AZL-72386 CVE-2025-13281 affecting package kubernetes for versions less than 1.28.4-21
A half-blind Server Side Request Forgery SSRF vulnerability exists in kube-controller-manager when using the in-tree Portworx StorageClass. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints in the control plane’s host network including link-local ...