Vulnerability · Published Dec 16, 2025 · Assigned by redhat

CVE-2025-14443Ose-openshift-apiserver: openshift api server: server-side request forgery (ssrf) vulnerability in imagestreamimport mechanism

Medium 6.4

In plain English

A medium-severity server-side request forgery in Red Hat OpenShift Container Platform 4 from Red Hat. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 27% of all known vulnerabilities).

Severity (CVSS 3.1)6.4Medium

Exploit odds (30 days)0.3%top 73.0% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

A flaw was found in ose-openshift-apiserver. This vulnerability allows internal network enumeration, service discovery, limited information disclosure, and potential denial-of-service (DoS) through Server-Side Request Forgery (SSRF) due to missing IP address and network-range validation when processing user-supplied image references.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Go	github.com/openshift/openshift-apiserver	no fix listed	GHSA-gxvv-45f6-3ch8
Go	github.com/openshift/openshift-apiserver	no fix listed	GHSA-gxvv-45f6-3ch8
Go	github.com/openshift/openshift-apiserver	no fix listed	GO-2026-4578

Affected products (as reported)

Vendor	Product	Versions
Red Hat	Red Hat OpenShift Container Platform 4	see references
Red Hat	Red Hat OpenShift Container Platform 4	see references

Weakness: CWE-918 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:N/A:L

References

https://access.redhat.com/security/cve/CVE-2025-14443 vdb-entry, x_refsource_REDHAT
RHBZ#2420964 issue-tracking, x_refsource_REDHAT
https://github.com/tuxerrante/openshift-ssrf