CVE-2025-14443 — Vulnerability in...

HIGH

openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References

Published December 16, 2025Updated March 23, 2026Source: osv

Summary

A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information disclosure, and potential Denial of Service (DoS) through Server-Side Request Forgery (SSRF) due to missing IP address and network-range validation when processing user-supplied image references.

Advisory Timeline

First published December 16, 2025 (300 days ago).
Last revised March 23, 2026 — 97 days after initial publication.

Affected Packages (2)

Affects 1 ecosystem: go (1).

Package	Ecosystem	Affected	Fixed In
github.com/openshift/openshift-apiserver	go	4.0.0-alpha.0	No fix available
github.com/openshift/openshift-apiserver	go	All versions	Range-based data available

Vulnerability Classification

Common Weakness Enumeration (CWE) identifiers for this vulnerability type.

CWE-918
Server-Side Request Forgery (SSRF)MITRE

CVSS Score Breakdown

What the CVSS (Common Vulnerability Scoring System) 8.5 score means for each attack dimension.

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Changed

Confidentiality

High

Integrity

None

Availability

Low

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L

References

Frequently Asked Questions

What is CVE-2025-14443?: openshift-apiserver: SSRF via Missing IP/Network-Range Validation in User-Supplied Image References This vulnerability has been assigned a severity rating of HIGH (CVSS score: 8.5/10).
How do I check if my project is affected by CVE-2025-14443?: CVE-2025-14443 affects github.com/openshift/openshift-apiserver. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2025-14443 and 200,000+ other known vulnerabilities.

Severity & Exploitability

CVSS Score

8.5

High exploitability or significant impact. Prioritize remediation within days.

Also Known As

GHSA-gxvv-45f6-3ch8

GO-2026-4578

Related CVEs

CVE-2026-107809
HIGH
Nginx-UI AuthRequired token cookie fallback enables CSRF against management APIs
CVE-2024-25131
HIGH
OpenShift Must Gather Operator Improper Input Validation vulnerability
CVE-2026-54167
HIGH
Pipelines-as-Code GitHub App token request can be redirected via untrusted Enterprise Host header
CVE-2026-107813
HIGH
Nginx UI: Incomplete fix of CVE-2026-84315 - the api/cluster router was not - wrapped in RequireSecureSession, so those sensitive mutations run without OTP step-up
CVE-2024-25133
HIGH
OpenShift Hive RCE through AWS/Kubernetes client configuration leads to privilege escalation
CVE-2024-45496
MEDIUM
OpenShift Controller Manager Improper Privilege Management
CVE-2024-7387
MEDIUM
OpenShift Builder has a path traversal, allows command injection in privileged BuildContainer

More Go Modules advisories

Check if you're affected

Scan your dependencies to see if this vulnerability affects your projects.

Scan Your Dependencies