Every CVE Search/ Get API key

CVE-2020-8563

Secret leaks in logs for vSphere Provider kube-controller-manager

4.7 MediumFix available

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.54%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 4.7

Secret leaks in logs for vSphere Provider kube-controller-manager

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Record
CVE-2020-8563
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
EUVDEUVD-2024-1110 4.7

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Record
EUVD-2024-1110
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-5xfg-wv98-264m 6.3

Sensitive Information leak via Log File in Kubernetes

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Record
GHSA-5xfg-wv98-264m
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
NVD 4.7

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Record
CVE-2020-8563
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSV 5.5

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Record
CVE-2020-8563
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGHSA-5xfg-wv98-264m 6.3

Sensitive Information leak via Log File in Kubernetes

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Record
GHSA-5xfg-wv98-264m
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
Show 4 moreShow less
OSVRHSA-2020:5260 6.3

Red Hat Security Advisory: OpenShift Container Platform 4.6.8 security and packages update

Record
RHSA-2020:5260
CVSS 3.1
6.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:N/A:N
Updated
2026-11-02
OSVUBUNTU-CVE-2020-8563 4.7

In Kubernetes clusters using VSphere as a cloud provider, with a logging level set to 4 or above, VSphere cloud credentials will be leaked in the cloud controller manager's log. This affects < v1.19.3.

Record
UBUNTU-CVE-2020-8563
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGO-2024-2755 No score

Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes

Sensitive Information leak for VSphere users via Log File in k8s.io/kubernetes

Record
GO-2024-2755
Updated
2026-11-02
OSVopenSUSE-SU-2025:15424-1 No score

govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15424-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/kubernetes/kubernetes
Go
 before 1.19.3
1.19.3
k8s.io/kubernetes
Go
 before 1.19.3
1.19.3
openshift
Red Hat:openshift:4.6::el7
 before 0:4.6.0-202012051246.p0.git.94231.efc9027.el7
0:4.6.0-202012051246.p0.git.94231.efc9027.el7
openshift-hyperkube
Red Hat:openshift:4.6::el7
 before 0:4.6.0-202012051246.p0.git.94231.efc9027.el7
0:4.6.0-202012051246.p0.git.94231.efc9027.el7
openshift
Red Hat:openshift:4.6::el8
 before 0:4.6.0-202012051246.p0.git.94231.efc9027.el8
0:4.6.0-202012051246.p0.git.94231.efc9027.el8
openshift-hyperkube
Red Hat:openshift:4.6::el8
 before 0:4.6.0-202012051246.p0.git.94231.efc9027.el8
0:4.6.0-202012051246.p0.git.94231.efc9027.el8
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 0.0.20250807T150727-1.1
0.0.20250807T150727-1.1

History

History
RecordedChangedSources
affected, facts
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8563 is a medium vulnerability (CVSS 4.7) in Kubernetes, published December 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in github.com/kubernetes/kubernetes 1.19.3.

References

Show 55 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open