Description
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | 1.18.0, 1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8, 1.9, 1.10, 1.11, 1.12, 1.13, 1.14, 1.15 – < 1.15.12, 1.16 – < 1.16.9, 1.17 – < 1.17.5 | 1.15.12 |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.18.2-1 | — |
| Debian 13 | kubernetes | 1.18.2-1 | — |
| Debian 12 | kubernetes | 1.18.2-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | openshift +1 | 4.2.36-202006211650.p0.git.0.1fe246f.el7 | RHSA-2020:2594, RHSA-2020:2448, RHSA-2020:2440 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.232-1.git.0.a5bc32f.el7 | RHSA-2020:2479 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Alpine
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.24 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.23 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.22 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.21 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.20 | k3s | 1.18.3.1-r0 | — |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Alpine v3.19 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.18 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.17 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.16 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.15 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.14 | k3s | 1.18.3.1-r0 | — |
| Alpine v3.13 | k3s | 1.18.3.1-r0 | — |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | grafana | 6.7.4-1.0.1.el7 | ELSA-2020-5726 |
| Oracle Linux 7 | kubeadm +2 | 1.12.10-1.0.12.el7 | ELSA-2020-5727, ELSA-2020-5726, ELSA-2020-5725 |
| Oracle Linux 7 | kubeadm-ha-setup | 0.0.2-1.0.70.el7 | ELSA-2020-5725 |
| Oracle Linux 7 | kubernetes-cni | 0.7.1-1.0.1.el7 | ELSA-2020-5727, ELSA-2020-5726, ELSA-2020-5725 |
| Oracle Linux 7 | kubernetes-cni-plugins | 0.8.6-1.0.2.el7 | ELSA-2020-5727, ELSA-2020-5726, ELSA-2020-5725 |
| Oracle Linux 7 | olcne-istio-chart +1 | 1.1.1-3.el7 | ELSA-2020-5726 |
| Oracle Linux 7 | olcnectl +4 | 1.0.4-2.el7 | ELSA-2020-5727, ELSA-2020-5726 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.18.0, < 1.18.1 | 1.18.1 | GHSA-x6mj-w4jf-jmgw |
| Go | k8s.io/kubernetes | >= 1.17.0, < 1.17.4 | 1.17.4 | GHSA-x6mj-w4jf-jmgw |
| Go | k8s.io/kubernetes | >= 1.16.0, < 1.16.9 | 1.16.9 | GHSA-x6mj-w4jf-jmgw |
| Go | k8s.io/kubernetes | < 1.15.12 | 1.15.12 | GHSA-x6mj-w4jf-jmgw |
| Go | k8s.io/kubernetes | < 1.15.12 · >= 1.16.0, < 1.16.9 · >= 1.17.0, < 1.17.4 · >= 1.18.0, < 1.18.1 | 1.15.12, 1.16.9, 1.17.4, 1.18.1 | GO-2022-0890 |
Advisories 9
- RHSA-2020:2479 Red Hat Security Advisory: OpenShift Container Platform 3.11 atomic-openshift security update Red Hat Security Advisories (RHSA) · Aug 5, 2026
- WID-SEC-2022-0510 IBM DB2: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RHSA-2020:2594 Red Hat Security Advisory: OpenShift Container Platform 4.2.36 openshift security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:2448 Red Hat Security Advisory: OpenShift Container Platform 4.4.8 openshift security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- RHSA-2020:2440 Red Hat Security Advisory: OpenShift Container Platform 4.3.25 openshift security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2020-5725 Important: kubernetes kubeadm-ha-setup kubernetes-cni kubernetes-cni-plugins security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 12, 2020
- ELSA-2020-5727 Important: kubernetes-cni-plugins kubernetes-cni kubernetes olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 12, 2020
- ELSA-2020-5726 Important: grafana kubernetes-cni kubernetes-cni-plugins kubernetes kubernetes olcne security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jun 12, 2020
References
- [oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager mailing-list
- https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion mailing-list
- https://github.com/kubernetes/kubernetes/issues/91542
- FEDORA-2020-aeea04cd13 vendor-advisory
- https://security.netapp.com/advisory/ntap-20200724-0005/
- [oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU mailing-list