{"id":"CVE-2020-8554","aliases":["AZL-31696","AZL-31731","AZL-34893","AZL-35135","DEBIAN-CVE-2020-8554","EUVD-2022-1072","GHSA-j9wf-vvm6-4r9w","RHSA-2021:0079","UBUNTU-CVE-2020-8554"],"status":"published","title":"Kubernetes man in the middle using LoadBalancer or ExternalIPs","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","severity":{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-08","score":0.08721,"percentile":0.95175,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-283"],"published":"2021-01-21T17:09:21Z","modified":"2026-11-05T05:40:51Z","exploits":[{"source":"pocgithub","id":"rancher/externalip-webhook","title":"rancher/externalip-webhook","date":"2020-12-01","url":"https://github.com/rancher/externalip-webhook"},{"source":"pocgithub","id":"jrmurray000/CVE-2020-8554","title":"jrmurray000/CVE-2020-8554","date":"2020-12-11","url":"https://github.com/jrmurray000/CVE-2020-8554"},{"source":"pocgithub","id":"twistlock/k8s-cve-2020-8554-mitigations","title":"twistlock/k8s-cve-2020-8554-mitigations","date":"2020-12-20","url":"https://github.com/twistlock/k8s-cve-2020-8554-mitigations"},{"source":"pocgithub","id":"Dviejopomata/CVE-2020-8554","title":"Dviejopomata/CVE-2020-8554","date":"2021-01-21","url":"https://github.com/Dviejopomata/CVE-2020-8554"},{"source":"pocgithub","id":"alebedev87/gatekeeper-cve-2020-8554","title":"alebedev87/gatekeeper-cve-2020-8554","date":"2021-02-09","url":"https://github.com/alebedev87/gatekeeper-cve-2020-8554"}],"fixes":[{"ecosystem":"Azure Linux:2","package":"python-kubernetes","fixed_in":["21.7.0-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:2","package":"kubernetes","fixed_in":["1.28.3-1"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"kubernetes","fixed_in":["1.28.3-2"],"sources":["osv"]},{"ecosystem":"Azure Linux:3","package":"python-kubernetes","fixed_in":["21.7.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.31.4+ds-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.31.4+ds-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"1.22.0"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"python-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.7.0-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:2","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-1"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.28.3-2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"python-kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"21.7.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.4+ds-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.4+ds-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"last_affected":"1.22.0"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.374-1.git.1675.738abcc.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-enterprise-service-catalog-svcat","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.11.374-1.git.1675.738abcc.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-clients-redistributable","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-cluster-autoscaler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.2996f62.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-descheduler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.299.f128e96.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-docker-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-dockerregistry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.481.e6a880c.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-excluder","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hyperkube","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-hypershift","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-master","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-metrics-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.53.9df25a9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-node-problem-detector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.263.28335fb.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-pod","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-sdn-ovs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-service-idler","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.15.523a1f7.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-template-service-broker","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-tests","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.ebd3ee9.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"atomic-openshift-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.647.9e78d83.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-openshift-oauth-proxy","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.439.966c536.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.3abd2a5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-node_exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.1062.490d6d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"golang-github-prometheus-prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.5026.29379c4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-autoheal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.218.9cf7939.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"openshift-enterprise-cluster-capacity","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.379.80bd08f.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.5026.29379c4.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-alertmanager","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.0.3abd2a5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"prometheus-node-exporter","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.11.374-1.git.1062.490d6d5.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"python-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.el7"}]}],"bundled":3},{"source":"osv","ecosystem":"Red Hat:openshift:3.11::el7","package":"python2-urllib3","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:1.26.2-1.el7"}]}],"bundled":3}],"products":[{"vendor":"kubernetes","product":"kubernetes"},{"vendor":"oracle","product":"communications_cloud_native_core_network_slice_selection_function"},{"vendor":"oracle","product":"communications_cloud_native_core_policy"},{"vendor":"oracle","product":"communications_cloud_native_core_service_communication_proxy"}],"references":[{"url":"https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/","tags":["x_refsource_MISC","article"]},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8","tags":["x_refsource_MISC","x_transferred","Mailing List","Third Party Advisory","advisory","web","article"]},{"url":"https://github.com/kubernetes/kubernetes/issues/97076","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","evidence","web","report"]},{"url":"https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942%40%3Ccommits.druid.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://www.oracle.com//security-alerts/cpujul2021.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpujan2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.oracle.com/security-alerts/cpuapr2022.html","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8554","tags":["web","advisory"]},{"url":"https://github.com/kubernetes/kubernetes/issues/97110","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6@%3Ccommits.druid.apache.org%3E","tags":["web"]},{"url":"https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves","tags":["web"]},{"url":"https://github.com/advisories/GHSA-j9wf-vvm6-4r9w"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8554","tags":["advisory"]},{"url":"https://github.com/kubernetes/kubernetes","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2021:0079","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1691529","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1866789","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1870050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1881319","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1883632","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1891051","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_0079.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2019-11840","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-11840","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-11840","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/golang-announce/tjyNcJxb2vQ/n0NRBziSCAAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8554","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8554","tags":["advisory","report"]},{"url":"https://blog.champtar.fr/K8S_MITM_LoadBalancer_ExternalIPs/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-26137","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-26137","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-26137","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2020-8554","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2020/12/07/5","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8554","title":"Kubernetes man in the middle using LoadBalancer or ExternalIPs","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:09:21.169Z","modified":"2026-06-01T21:44:19.351Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-283"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2022-1072","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:09:21Z","modified":"2026-06-01T21:44:19Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T18:20:57.828765Z"}],"ghsa":[{"id":"GHSA-j9wf-vvm6-4r9w","title":"Unverified Ownership in Kubernetes","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2022-02-08T21:50:34Z","modified":"2026-06-09T10:51:32Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-283"],"updated_at":"2026-11-02T14:40:23.739691Z"}],"nvd":[{"id":"CVE-2020-8554","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:15:13.843Z","modified":"2026-06-17T03:26:32.447Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"secondary"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-283"],"updated_at":"2026-11-02T14:06:30.596418Z"}],"osv":[{"id":"AZL-31696","title":"CVE-2020-8554 affecting package python-kubernetes for versions less than 21.7.0-1","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:15:13Z","modified":"2026-04-21T04:26:27.965166Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-31731","title":"CVE-2020-8554 affecting package kubernetes for versions less than 1.28.3-1","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:15:13Z","modified":"2026-04-21T04:26:28.721775Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:28:03.46006Z"},{"id":"AZL-34893","title":"CVE-2020-8554 affecting package kubernetes for versions less than 1.28.3-2","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:15:13Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:19.380321Z"},{"id":"AZL-35135","title":"CVE-2020-8554 affecting package python-kubernetes for versions less than 21.7.0-1","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:15:13Z","modified":"2026-11-05T05:40:51Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-05T16:41:19.554273Z"},{"id":"CVE-2020-8554","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:15:13.843Z","modified":"2026-10-20T10:54:25.320145641Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8554","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2021-01-21T17:15:13.843Z","modified":"2026-10-26T12:02:51.618212428Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-j9wf-vvm6-4r9w","title":"Unverified Ownership in Kubernetes","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"published","published":"2022-02-08T21:50:34Z","modified":"2026-09-10T03:49:28.093743138Z","cvss":[{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"cwes":["CWE-283"],"updated_at":"2026-11-02T15:46:50.336262Z"},{"id":"RHSA-2021:0079","title":"Red Hat Security Advisory: OpenShift Container Platform 3.11.374 bug fix and security update","status":"published","published":"2024-09-18T04:29:41Z","modified":"2026-06-29T10:33:37Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:53:08.071325Z"},{"id":"UBUNTU-CVE-2020-8554","description":"Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.","status":"withdrawn","published":"2021-01-21T17:15:00Z","modified":"2025-07-14T06:45:30.360361Z","cvss":[{"version":"3.1","score":6.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"},{"version":"3.1","score":5,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"}]}}