CVE-2020-8558 - CVE House
Back to Database
Status published Medium CVE-2020-8558

Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

Vulnerability Description

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2020-8558

Credits & Attribution

The following person or organization is credited with identifying this vulnerability, as recorded in the NVD database:

  • János Kövér, Ericsson
  • Additional impacts reported by Rory McCune, NCC Group and Yuval Avrahami and Ariel Zelivansky, Palo Alto Networks

References

More from Kubernetes

View All →
CVE-2025-9708
Kubernetes C# Client: improper certificate validation in custom CA mode may lead to man-in-the-middle attacks
Medium 6.8
CVE-2025-7445
Kubernetes secrets-store-sync-controller discloses service account tokens in logs
Medium 6.5
CVE-2025-7342
VM images built with Kubernetes Image Builder Nutanix or OVA providers use default credentials for Windows images if user did not override
High 7.5
CVE-2025-5187
Nodes can delete themselves by adding an OwnerReference
Medium 6.7
CVE-2025-4563
Nodes can bypass dynamic resource allocation authorization checks
Low 2.7

Affected Vendor

Affected Software

Kubernetes
Vulnerable Versions:
prior to 1.18.4, prior to 1.17.7, prior to 1.16.11, 1.15, 1.14, 1.13, 1.12, 1.11, 1.10, 1.9, 1.8, 1.7, 1.6, 1.5, 1.4, 1.3, 1.2, 1.1

Timeline

Official Publish: July 27th, 2020
Last Modified: September 16th, 2024
Added to House: July 21st, 2026

CVSS Vectors

V3: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Weaknesses (CWE)

CWE-420

MITRE ATT&CK TTPs

No associated TTPs found for this vulnerability.