CVE-2020-8565: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

Severity: medium (CVSS 5.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2020-12-07 · updated 2026-06-17
Weakness: CWE-532

Description

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

Affected products

Kubernetes: from 1.17.0 through 1.17.13; from 1.18.0 through 1.18.10; from 1.19.0 through 1.19.3

References

https://github.com/kubernetes/kubernetes/issues/95623
https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
https://github.com/kubernetes/kubernetes/issues/95623
https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ

Get alerted when CVE-2020-8565 or the next vulnerability affects your stack