Description
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Kubernetes | Kubernetes | prior to 1.18.4, prior to 1.17.7, prior to 1.16.11, 1.15, 1.14, 1.13, 1.12, 1.11, 1.10, 1.9, 1.8, 1.7, 1.6, 1.5, 1.4, 1.3, 1.2, 1.1 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | kubernetes | 1.18.5-1 | — |
| Debian 13 | kubernetes | 1.18.5-1 | — |
| Debian 12 | kubernetes | 1.18.5-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 4 | machine-config-daemon | 4.4.0-202007092124.p0.git.2349.08d34d1.el8 | RHSA-2020:2927, RHSA-2020:2413 |
| Red Hat OpenShift 4 | openshift +1 | 4.3.31-202007280738.p0.git.0.9884401.el7 | RHSA-2020:3183, RHSA-2020:2927, RHSA-2020:2413 |
| Red Hat OpenShift 3 | atomic-openshift +12 | 3.11.248-1.git.0.92ee8ac.el7 | RHSA-2020:2992 |
| Red Hat OpenShift 3 | atomic-openshift-web-console | 3.11.248-1.git.1.cc96c2d.el7 | RHSA-2020:2992 |
| Red Hat OpenShift 3 | cri-o | 1.11.16-0.10.dev.rhaos3.11.git1eee681.el7 | RHSA-2020:2992 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | govulncheck-vulndb | 0.0.20250807T150727-1.1 | openSUSE-SU-2025:15424-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
GitHub 2 repositories
-
tabbysable/POC-2020-8558 ★ 43 · Jul 9, 2020
Information about Kubernetes CVE-2020-8558, including proof of concept exploit.
-
rhysemmas/martian-packets ★ 3 · Jul 17, 2020
Crafting raw TCP/IP packets to send to poorly configured Kubernetes servers - CVE-2020-8558 PoC
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Go | k8s.io/kubernetes | >= 1.18.0, < 1.18.4 | 1.18.4 | GHSA-wqv3-8cm6-h6wg |
| Go | k8s.io/kubernetes | >= 1.17.0, < 1.17.7 | 1.17.7 | GHSA-wqv3-8cm6-h6wg |
| Go | k8s.io/kubernetes | < 1.16.11 | 1.16.11 | GHSA-wqv3-8cm6-h6wg |
| Go | k8s.io/kubernetes | < 1.16.11 · >= 1.17.0, < 1.17.7 · >= 1.18.0, < 1.18.4 | 1.16.11, 1.17.7, 1.18.4 | GO-2022-0885 |
Advisories 5
- RHSA-2020:2413 Red Hat Security Advisory: OpenShift Container Platform 4.5 package security update Red Hat Security Advisories (RHSA) · Oct 19, 2026
- RHSA-2020:2992 Red Hat Security Advisory: OpenShift Container Platform 3.11 security update Red Hat Security Advisories (RHSA) · Oct 9, 2026
- openSUSE-SU-2025:15424-1 govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- RHSA-2020:2927 Red Hat Security Advisory: OpenShift Container Platform 4.4.13 machine-config-daemon and openshift security update Red Hat Security Advisories (RHSA) · Mar 23, 2026
- RHSA-2020:3183 Red Hat Security Advisory: OpenShift Container Platform 4.3.31 openshift security update Red Hat Security Advisories (RHSA) · Nov 22, 2025