What’s Vulnerable › Vulnerabilities

CVE-2020-8559: Privilege escalation from compromised node to cluster

• Severity: medium (CVSS 6.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 6.1% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-07-22 · updated 2026-06-17
• Weakness: CWE-601

Description

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Affected products

• Kubernetes: from 1.6.0 through 1.15.0; from 1.16.0 before 1.16.13; from 1.17.0 before 1.17.9; from 1.18.0 before 1.18.6 — fixed in 1.16.13, 1.17.9, 1.18.6

How to fix

Upgrade to a fixed version: Kubernetes 1.16.13, 1.17.9, 1.18.6. Check the vendor advisory for mitigations.

References

• https://github.com/kubernetes/kubernetes/issues/92914
• https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ
• https://security.netapp.com/advisory/ntap-20200810-0004/
• https://github.com/kubernetes/kubernetes/issues/92914
• https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ
• https://security.netapp.com/advisory/ntap-20200810-0004/

Get alerted when CVE-2020-8559 or the next vulnerability affects your stack