Every CVE Search/ Get API key

CVE-2020-8566

Ceph RBD adminSecrets exposed in logs when loglevel >= 4

4.7 MediumFix available

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
High
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
None
Availability
None

Exploit likelihood

0.53%Down 0.3 points since Apr 14, 2021
90%50%10%1%

What each source reports

CVE List Score used 4.7

Ceph RBD adminSecrets exposed in logs when loglevel >= 4

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
CVE-2020-8566
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
EUVDEUVD-2024-1109 4.7

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
EUVD-2024-1109
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-5x96-j797-5qqw 5.3

Sensitive Information leak via Log File in Kubernetes

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
GHSA-5x96-j797-5qqw
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
NVD 4.7

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
CVE-2020-8566
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0
2.1 LowAV:L/AC:L/Au:N/C:P/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSV 5.5

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
CVE-2020-8566
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2020-8566 5.5

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
DEBIAN-CVE-2020-8566
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-5x96-j797-5qqw 5.3

Sensitive Information leak via Log File in Kubernetes

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
GHSA-5x96-j797-5qqw
CVSS 3.1
5.3 MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weakness
CWE-532
Updated
2026-11-02
OSVRHSA-2020:5634 8.6

Red Hat Security Advisory: OpenShift Container Platform 4.7.0 packages security update

Record
RHSA-2020:5634
CVSS 3.1
8.6 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2020-8566 4.7

In Kubernetes clusters using Ceph RBD as a storage provisioner, with logging level of at least 4, Ceph RBD admin secrets can be written to logs. This occurs in kube-controller-manager's logs during provisioning of Ceph RBD persistent claims. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Record
UBUNTU-CVE-2020-8566
CVSS 3.1
4.7 MediumCVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
CVSS 3.1
5.5 MediumCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Updated
2026-11-02
OSVGO-2024-2754 No score

Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes

Sensitive Information leak for users of Ceph RBD via Log File in k8s.io/kubernetes

Record
GO-2024-2754
Updated
2026-11-02
OSVopenSUSE-SU-2025:15424-1 No score

govulncheck-vulndb-0.0.20250807T150727-1.1 on GA media

These are all security issues fixed in the govulncheck-vulndb-0.0.20250807T150727-1.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2025:15424-1
Updated
2026-11-02
OSVSUSE-SU-2020:3760-1 No score

Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package

= Required Actions

== Kubernetes & etcd (Security fixes)

This fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_updating_kubernetes_components for the upgrade procedure.

== Skuba & helm/helm3

In order to update skuba and helm or helm 3, you need to update the management workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_update_management_workstation

= Known Issues

Modifying the file /etc/sysconfig/kubelet directly is not supported: documentation at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_miscellaneous.html#_configuring_kubelet

Be sure to check the Release Notes at https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2_4 for any additional known issues or behavioral changes.

Record
SUSE-SU-2020:3760-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
github.com/kubernetes/kubernetes
Go
 before 1.17.13
1.17.13
github.com/kubernetes/kubernetes
Go
 1.18.0 up to 1.18.10
1.18.10
github.com/kubernetes/kubernetes
Go
 1.19.0 up to 1.19.3
1.19.3
kubernetes
Debian:12
 before 1.19.3-1
1.19.3-1
kubernetes
Debian:13
 before 1.19.3-1
1.19.3-1
kubernetes
Debian:14
 before 1.19.3-1
1.19.3-1
k8s.io/kubernetes
Go
 before 1.17.13, 1.18.0 up to 1.18.10, 1.19.0 up to 1.19.3
1.17.131.18.101.19.3
openshift
Red Hat:openshift:4.7::el7
From an advisory covering 6 CVEs
 before 0:4.7.0-202102060108.p0.git.97095.7271b90.el7
0:4.7.0-202102060108.p0.git.97095.7271b90.el7
openshift-hyperkube
Red Hat:openshift:4.7::el7
From an advisory covering 6 CVEs
 before 0:4.7.0-202102060108.p0.git.97095.7271b90.el7
0:4.7.0-202102060108.p0.git.97095.7271b90.el7
openshift
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:4.7.0-202102060108.p0.git.97095.7271b90.el8
0:4.7.0-202102060108.p0.git.97095.7271b90.el8
Show 20 moreShow less
Affected packages
PackageAffectedFixed
openshift-hyperkube
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:4.7.0-202102060108.p0.git.97095.7271b90.el8
0:4.7.0-202102060108.p0.git.97095.7271b90.el8
python-rsa
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:4.7-1.el8
0:4.7-1.el8
python3-rsa
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:4.7-1.el8
0:4.7-1.el8
ignition
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:2.9.0-2.rhaos4.7.git1d56dc8.el8
0:2.9.0-2.rhaos4.7.git1d56dc8.el8
ignition-debuginfo
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:2.9.0-2.rhaos4.7.git1d56dc8.el8
0:2.9.0-2.rhaos4.7.git1d56dc8.el8
ignition-debugsource
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:2.9.0-2.rhaos4.7.git1d56dc8.el8
0:2.9.0-2.rhaos4.7.git1d56dc8.el8
ignition-validate
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:2.9.0-2.rhaos4.7.git1d56dc8.el8
0:2.9.0-2.rhaos4.7.git1d56dc8.el8
ignition-validate-debuginfo
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:2.9.0-2.rhaos4.7.git1d56dc8.el8
0:2.9.0-2.rhaos4.7.git1d56dc8.el8
cri-o
Red Hat:openshift:4.7::el7
From an advisory covering 6 CVEs
 before 0:1.20.0-0.rhaos4.7.git8921e00.el7.51
0:1.20.0-0.rhaos4.7.git8921e00.el7.51
cri-o-debuginfo
Red Hat:openshift:4.7::el7
From an advisory covering 6 CVEs
 before 0:1.20.0-0.rhaos4.7.git8921e00.el7.51
0:1.20.0-0.rhaos4.7.git8921e00.el7.51
cri-tools
Red Hat:openshift:4.7::el7
From an advisory covering 6 CVEs
 before 0:1.18.0-3.el7
0:1.18.0-3.el7
cri-tools-debuginfo
Red Hat:openshift:4.7::el7
From an advisory covering 6 CVEs
 before 0:1.18.0-3.el7
0:1.18.0-3.el7
cri-o
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:1.20.0-0.rhaos4.7.git8921e00.el8.51
0:1.20.0-0.rhaos4.7.git8921e00.el8.51
cri-o-debuginfo
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:1.20.0-0.rhaos4.7.git8921e00.el8.51
0:1.20.0-0.rhaos4.7.git8921e00.el8.51
cri-o-debugsource
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:1.20.0-0.rhaos4.7.git8921e00.el8.51
0:1.20.0-0.rhaos4.7.git8921e00.el8.51
cri-tools
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:1.20.0-1.el8
0:1.20.0-1.el8
cri-tools-debuginfo
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:1.20.0-1.el8
0:1.20.0-1.el8
cri-tools-debugsource
Red Hat:openshift:4.7::el8
From an advisory covering 6 CVEs
 before 0:1.20.0-1.el8
0:1.20.0-1.el8
kubernetes
SUSE:Linux Enterprise Module for Containers 15 SP1
From an advisory covering 8 CVEs
 before 1.17.13-4.21.2
1.17.13-4.21.2
govulncheck-vulndb
openSUSE:Tumbleweed
From an advisory covering 44 CVEs
 before 0.0.20250807T150727-1.1
0.0.20250807T150727-1.1

History

History
RecordedChangedSources
affected, facts
affected
aliases, publishedEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2020-8566 is a medium vulnerability (CVSS 4.7) in Kubernetes, published December 7, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.53%, the 44th percentile. Fixed in github.com/kubernetes/kubernetes 1.17.13.

References

Show 96 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open