Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
9.8

ThermaKube Master Allows Malicious Requests to Access Unintended Network Locations

CVE-2025-70042 · published 8 months ago
Summary

A security issue was found in the oslabs-beta version of ThermaKube's master component. This issue allows an attacker to trick the system into accessing unauthorized network locations, potentially leading to data breaches or other security risks. Users are advised to update to a patched version of ThermaKube to prevent this vulnerability.

Original advisory text
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.
An issue pertaining to CWE-918: Server-Side Request Forgery was discovered in oslabs-beta ThermaKube master.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
9.8 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-918Server-Side Request Forgery (SSRF)
Timeline
Published9 Mar 2026
Updated4 Nov 2026
First seen9 Mar 2026
Sources
CVE-2025-70042 · NVD
Track software like this
Free during beta