CVE-2025-13281

This issue is classified as a Moderate vulnerability rather than an Important flaw because its exploitability and impact are significantly constrained by design and configuration prerequisites. Exploitation requires pre-existing high privileges, as the attacker must already be authorized to create pods using the legacy in-tree Portworx StorageClass, which is typically restricted in production clusters. The SSRF is half-blind, limiting the attacker’s ability to reliably control requests or exfiltrate data, and it only becomes meaningful when unprotected endpoints are exposed on the control plane host network, a condition that does not exist in properly hardened environments. There is no direct integrity or availability impact, no privilege escalation, and no code execution path. Additionally, the affected component is disabled by default in supported Kubernetes versions, further reducing real-world exposure. These technical constraints and dependency on non-default or misconfigured setups justify a moderate severity assessment rather than classification as an important flaw.