Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
Kube-controller-manager can expose internal services via Portworx
published 4 months ago
Summary
If you use the built-in Portworx storage option, an attacker with a valid account could trick the controller into contacting internal network services and reading their data. This could reveal information from services that are not meant to be publicly reachable, such as local or link-local endpoints. To protect yourself, avoid using the in-tree Portworx storage class or apply the latest patches and restrict network access to the controller's host.
What to do
- Update echo rancher-kuberlr-kubectl-3 to version 3.0.3+e1.
- Update echo rancher-kuberlr-kubectl-4 to version 4.1.1+e1.
- Update echo rancher-kuberlr-kubectl-5 to version 5.1.1+e1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Echo | echo | rancher-kuberlr-kubectl-3 |
< 3.0.3+e1 Fix: upgrade to 3.0.3+e1
|
| Echo | echo | rancher-kuberlr-kubectl-4 |
< 4.1.1+e1 Fix: upgrade to 4.1.1+e1
|
| Echo | echo | rancher-kuberlr-kubectl-5 |
< 5.1.1+e1 Fix: upgrade to 5.1.1+e1
|
Original advisory text
ECHO-d43d-bac8-84e2
Timeline
Published22 Jun 2026
Updated22 Jun 2026
First seen22 Jun 2026
Sources
ECHO-d43d-bac8-84e2 · OSV
Track software like this
Free during beta