{"id":"CVE-2020-8565","aliases":["AZL-41878","DEBIAN-CVE-2020-8565","EUVD-2023-0665","GHSA-8cfg-vx93-jvxw","GO-2021-0064","RHSA-2021:5085","SUSE-SU-2020:3760-1","UBUNTU-CVE-2020-8565"],"status":"published","title":"Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \u003e= 9","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","severity":{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00518,"percentile":0.44335,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-532"],"published":"2020-12-07T22:00:19Z","modified":"2026-10-26T12:02:54Z","fixes":[{"ecosystem":"Go","package":"k8s.io/client-go","fixed_in":["0.19.6","0.20.0-alpha.2","0.18.14","0.17.16"],"sources":["ghsa","osv"]},{"ecosystem":"Go","package":"k8s.io/kubernetes","fixed_in":["1.20.0-alpha.2"],"sources":["ghsa","osv"]},{"ecosystem":"Azure Linux:3","package":"local-path-provisioner","fixed_in":["0.0.24-5"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"kubernetes","fixed_in":["1.20.0-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"kubernetes","fixed_in":["1.20.0-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"kubernetes","fixed_in":["1.20.0-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.19.0"},{"fixed":"0.19.6"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.20.0-alpha.0"},{"fixed":"0.20.0-alpha.2"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0.18.0"},{"fixed":"0.18.14"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.17.16"}]}]},{"source":"ghsa","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-alpha.2"}]}]},{"source":"osv","ecosystem":"Azure Linux:3","package":"local-path-provisioner","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.0.24-5"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.20.0-1"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0.19.0"},{"fixed":"0.19.6"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0.20.0-alpha.0"},{"fixed":"0.20.0-alpha.2"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0.18.0"},{"fixed":"0.18.14"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.17.16"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/kubernetes","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.20.0-alpha.2"}]}]},{"source":"osv","ecosystem":"Go","package":"k8s.io/client-go","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"0.20.0-alpha.2"}]}]},{"source":"osv","ecosystem":"Red Hat:openshift_data_foundation:4.9::el8","package":"mcg","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.9.0-28.61dcf87.5.9.el8"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 15 SP1","package":"kubernetes","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.17.13-4.21.2"}]}],"bundled":8}],"products":[{"vendor":"kubernetes","product":"kubernetes"}],"references":[{"url":"https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://github.com/kubernetes/kubernetes/issues/95623","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8565","tags":["web","advisory"]},{"url":"https://github.com/kubernetes/kubernetes/pull/95316","tags":["web","fix","report"]},{"url":"https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419","tags":["web","fix"]},{"url":"https://pkg.go.dev/vuln/GO-2021-0064","tags":["web"]},{"url":"https://github.com/kubernetes/client-go/commit/19875a3d5a2e0d4f51c976a9e0662de3c2c011e3","tags":["web"]},{"url":"https://github.com/kubernetes/client-go/commit/1b8383fc150c9b816b0072032cca75754c2734d0","tags":["web"]},{"url":"https://github.com/kubernetes/client-go/commit/44e1a07f2d513e375c4b6ee6e890040b47befe86","tags":["web"]},{"url":"https://github.com/kubernetes/client-go/commit/e8f871a2e5fadf90fc114565abc0963967f1a373","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8cfg-vx93-jvxw"},{"url":"https://security-tracker.debian.org/tracker/CVE-2020-8565","tags":["advisory"]},{"url":"https://github.com/kubernetes/client-go","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2021:5085","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#moderate","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1886638","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1983596","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989564","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989570","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1989575","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1996033","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1998680","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_5085.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2020-8565","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2020-8565","tags":["advisory","report"]},{"url":"https://groups.google.com/g/kubernetes-announce/c/ScdmyORnPDk","tags":["article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33195","tags":["advisory"]},{"url":"https://groups.google.com/g/golang-announce/c/RgCMkAEQjSI","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33197","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33197","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33197","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-33198","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-33198","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-33198","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2021-34558","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-34558","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-34558","tags":["advisory"]},{"url":"https://golang.org/doc/devel/release#go1.15.minor","tags":["article"]},{"url":"https://golang.org/doc/devel/release#go1.16.minor","tags":["article"]},{"url":"https://www.suse.com/support/update/announcement/2020/suse-su-20203760-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1174219","tags":["report"]},{"url":"https://bugzilla.suse.com/1174951","tags":["report"]},{"url":"https://bugzilla.suse.com/1176752","tags":["report"]},{"url":"https://bugzilla.suse.com/1176753","tags":["report"]},{"url":"https://bugzilla.suse.com/1176754","tags":["report"]},{"url":"https://bugzilla.suse.com/1176755","tags":["report"]},{"url":"https://bugzilla.suse.com/1177661","tags":["report"]},{"url":"https://bugzilla.suse.com/1177662","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15106","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15112","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-15187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8565","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8566","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2020-8565","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2020-8565","title":"Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel \u003e= 9","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","status":"published","published":"2020-12-07T22:00:19.374Z","modified":"2024-09-17T00:05:58.669Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:35:50.545879Z"}],"euvd":[{"id":"EUVD-2023-0665","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","status":"published","published":"2020-12-07T22:00:19Z","modified":"2024-09-17T00:05:58Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-03T00:29:02.472621Z"}],"ghsa":[{"id":"GHSA-8cfg-vx93-jvxw","title":"Kubernetes client-go vulnerable to Sensitive Information Leak via Log File","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.5, \u003c= v1.18.13, \u003c= v1.17.15, \u003c v1.20.0-alpha2.","status":"published","published":"2023-02-06T23:27:56Z","modified":"2024-05-20T19:48:13Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:37:50.750599Z"}],"nvd":[{"id":"CVE-2020-8565","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","status":"published","published":"2020-12-07T22:15:21.4Z","modified":"2026-06-17T03:26:33.73Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":2.1,"vector":"AV:L/AC:L/Au:N/C:P/I:N/A:N","level":"low","assessor":"primary"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T14:06:27.10541Z"}],"osv":[{"id":"AZL-41878","title":"CVE-2020-8565 affecting package local-path-provisioner for versions less than 0.0.24-5","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","status":"published","published":"2020-12-07T22:15:21Z","modified":"2026-04-21T04:49:33.862762Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:28:04.893995Z"},{"id":"CVE-2020-8565","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","status":"published","published":"2020-12-07T22:15:21.4Z","modified":"2026-10-24T10:51:23.751578257Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:17.663289Z"},{"id":"DEBIAN-CVE-2020-8565","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","status":"published","published":"2020-12-07T22:15:21.4Z","modified":"2026-10-26T12:02:54.965074001Z","cvss":[{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.311861Z"},{"id":"GHSA-8cfg-vx93-jvxw","title":"Kubernetes client-go vulnerable to Sensitive Information Leak via Log File","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.5, \u003c= v1.18.13, \u003c= v1.17.15, \u003c v1.20.0-alpha2.","status":"published","published":"2023-02-06T23:27:56Z","modified":"2026-09-10T03:49:51.898248948Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"cwes":["CWE-532"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"RHSA-2021:5085","title":"Red Hat Security Advisory: Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update","status":"published","published":"2024-09-29T18:30:20Z","modified":"2026-08-05T10:09:46Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:09.077222Z"},{"id":"UBUNTU-CVE-2020-8565","description":"In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects \u003c= v1.19.3, \u003c= v1.18.10, \u003c= v1.17.13, \u003c v1.20.0-alpha2.","status":"withdrawn","published":"2020-12-07T22:15:00Z","modified":"2025-07-14T06:45:30.800709Z","cvss":[{"version":"3.1","score":4.7,"vector":"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"},{"version":"3.1","score":5.5,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:25.728622Z"},{"id":"GO-2021-0064","title":"Unauthorized credential disclosure via debug logs in k8s.io/kubernetes and k8s.io/client-go","description":"Authorization tokens may be inappropriately logged if the verbosity level is set to a debug level. This is due to an incomplete fix for CVE-2019-11250.","status":"published","published":"2021-04-14T20:04:52Z","modified":"2026-02-04T02:20:03.995689Z","updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"SUSE-SU-2020:3760-1","title":"Security changes in Kubernetes, etcd, and helm; Bugfix in cri-o package","description":" = Required Actions\n\n== Kubernetes \u0026 etcd (Security fixes)\n\nThis fix involves an upgrade of Kubernetes and some add-ons. See https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_updating_kubernetes_components for the upgrade procedure.\n   \n== Skuba \u0026 helm/helm3\n\nIn order to update skuba and helm or helm 3, you need to update the management workstation. See detailed instructions at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_cluster_updates.html#_update_management_workstation\n\n= Known Issues\n\nModifying the file `/etc/sysconfig/kubelet` directly is not supported: documentation at https://documentation.suse.com/suse-caasp/4.2/html/caasp-admin/_miscellaneous.html#_configuring_kubelet\n\nBe sure to check the Release Notes at https://www.suse.com/releasenotes/x86_64/SUSE-CAASP/4/#_changes_in_4_2_4 for any additional known issues or behavioral changes.","status":"published","published":"2020-12-23T08:18:56Z","modified":"2026-02-04T02:46:33.165107Z","updated_at":"2026-11-02T15:53:48.690034Z"}]}}