PT-2020-20205 · Kubernetes · Kubernetes

Published

2020-12-08

·

Updated

2026-05-27

·

CVE-2020-8554

CVSS v3.1

6.3

Medium

VectorAV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
Name of the Vulnerable Software and Affected Versions Kubernetes API server versions prior to a fixed version (the fixed version is not specified)
Description The issue allows an attacker who can create a ClusterIP service and set the spec.externalIPs field to intercept traffic to that IP address. Additionally, an attacker who can patch the status of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect, potentially allowing for man-in-the-middle attacks. This behavior is considered a design flaw and has been known since 2016.
Recommendations As a temporary workaround, consider using admission controllers to restrict the creation of ClusterIP services with the spec.externalIPs field set. Restrict access to patch the status of LoadBalancer services to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

Related Identifiers

AZL-31696
AZL-31731
AZL-34893
AZL-35135
CVE-2020-8554
GHSA-J9WF-VVM6-4R9W
RHSA-2021:0079

Affected Products

Kubernetes