Description
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | — | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.31.4+ds-1 | — |
| Debian 13 | kubernetes | 1.31.4+ds-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 3 | atomic-enterprise-service-catalog +1 | 1:3.11.374-1.git.1675.738abcc.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.374-1.git.0.ebd3ee9.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | atomic-openshift-cluster-autoscaler | 3.11.374-1.git.0.2996f62.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | atomic-openshift-descheduler | 3.11.374-1.git.299.f128e96.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | atomic-openshift-dockerregistry | 3.11.374-1.git.481.e6a880c.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | atomic-openshift-metrics-server | 3.11.374-1.git.53.9df25a9.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | atomic-openshift-node-problem-detector | 3.11.374-1.git.263.28335fb.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | atomic-openshift-service-idler | 3.11.374-1.git.15.523a1f7.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.11.374-1.git.647.9e78d83.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | golang-github-openshift-oauth-proxy | 3.11.374-1.git.439.966c536.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | openshift-enterprise-autoheal | 3.11.374-1.git.218.9cf7939.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | openshift-enterprise-cluster-capacity | 3.11.374-1.git.379.80bd08f.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | prometheus +1 | 3.11.374-1.git.5026.29379c4.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | prometheus-alertmanager +1 | 3.11.374-1.git.0.3abd2a5.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | prometheus-node-exporter +1 | 3.11.374-1.git.1062.490d6d5.el7 | RHSA-2021:0079 |
| Red Hat OpenShift 3 | python-urllib3 +1 | 1.26.2-1.el7 | RHSA-2021:0079 |
Azure Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Azure Linux 3 | kubernetes | 1.28.3-2 | — |
| Azure Linux 3 | python-kubernetes | 21.7.0-1 | — |
| Azure Linux 2 (CBL-Mariner) | kubernetes | 1.28.3-1 | — |
| Azure Linux 2 (CBL-Mariner) | python-kubernetes | 21.7.0-1 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | kata | 1.7.3-1.0.12.el7 | ELSA-2021-9029, ELSA-2021-9028 |
| Oracle Linux 7 | kata-image | 1.11.5-1.1.ol8_202101151826 | ELSA-2021-9028 |
| Oracle Linux 7 | kata-runtime | 1.7.3-1.0.7.el7 | ELSA-2021-9029, ELSA-2021-9028 |
| Oracle Linux 7 | kata-shim +3 | 1.11.5-1.el8 | ELSA-2021-9028 |
| Oracle Linux 7 | kubeadm +2 | 1.17.9-1.0.6.el7 | ELSA-2021-9029, ELSA-2021-9028 |
| Oracle Linux 7 | olcnectl +6 | 1.1.10-1.el7 | ELSA-2021-9029, ELSA-2021-9028 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | kubernetes-1.34 +3 | No fix yet | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 5 repositories
-
rancher/externalip-webhook ★ 3 · Dec 1, 2020
CVE-2020-8554: Man in the middle using LoadBalancer or ExternalIPs
-
twistlock/k8s-cve-2020-8554-mitigations ★ 1 · Dec 20, 2020
Prisma Cloud Compute Admission rules to mitigate Kubernetes CVE-2020-8554
-
jrmurray000/CVE-2020-8554 ★ 1 · Dec 11, 2020
Mitigate CVE-2020-8554 with Policy Controller in Anthos
-
alebedev87/gatekeeper-cve-2020-8554 ★ 0 · Feb 9, 2021
-
Dviejopomata/CVE-2020-8554 ★ 0 · Jan 21, 2021
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | <= 1.22.0 | — | GHSA-j9wf-vvm6-4r9w |
Advisories 4
- RHSA-2021:0079 Red Hat Security Advisory: OpenShift Container Platform 3.11.374 bug fix and security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- ELSA-2021-9028 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 10, 2021
- ELSA-2021-9029 Important: olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Feb 10, 2021
References
- https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/
- https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8
- https://github.com/kubernetes/kubernetes/issues/97076
- [druid-commits] 20210201 [GitHub] [druid] jon-wei opened a new pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554 mailing-list
- [druid-commits] 20210202 [GitHub] [druid] jon-wei opened a new pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554 mailing-list
- [druid-commits] 20210203 [GitHub] [druid] jihoonson commented on pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554 mailing-list
- [druid-commits] 20210203 [GitHub] [druid] jihoonson merged pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554 mailing-list
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://www.oracle.com/security-alerts/cpujan2022.html
- https://www.oracle.com/security-alerts/cpuapr2022.html