Kubernetes Portworx StorageClass Half-Blind Server Side Request Forgery Vulnerability in kube-controller-manager

A half-blind Server Side Request Forgery (SSRF) vulnerability has been identified in the Kubernetes kube-controller-manager, specifically when the in-tree Portworx StorageClass is used. This vulnerability allows authorized users to leak arbitrary information from unprotected endpoints within the control plane's host network, including link-local or loopback services. The issue arises because kube-controller-manager can be manipulated to send GET requests from the host network, exposing the response data through event objects created by the manager.

Impact

Exploitation of this vulnerability could lead to unauthorized information disclosure from the control plane's host network, potentially exposing sensitive data from link-local or loopback services.

Remediation

Users can upgrade to kube-controller-manager versions 1.32.10, 1.33.6, or 1.34.2, or enable the CSIMigrationPortworx feature gate if it was manually disabled.