Kubernetes man in the middle using LoadBalancer or ExternalIPs
Priority LOW 39CWE-283Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Low · Low · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.
Summary
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Why it matters now
EPSS 0.08721 95th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Fixed Red Hat: 1 advisory
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | all versions | — | No fix listed | CNA |
| — | k8s.io/kubernetes (Go) | up to 1.22.0 | — | No fix listed | GHSA-j9wf-vvm6-4r9w |
- Kubernetes VendorKubernetes Affected all versions Fixed in — No fix listed CNA
- k8s.io/kubernetes (Go) Vendor— Affected up to 1.22.0 Fixed in — No fix listed GHSA-j9wf-vvm6-4r9w
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | all versions | Vulnerable | Kubernetes |
| cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* | 1.2.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* | 1.15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions all versions Vulnerable ·Kubernetes
- cpe:2.3:a:oracle:communications_cloud_native_core_network_slice_selection_function:1.2.1:*:*:*:*:*:*:* Versions 1.2.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.15.0:*:*:*:*:*:*:* Versions 1.15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
Remediation
Red Hat 1 advisory
- RHSA-2021:0079 Released 2021-01-20 · Red Hat rating ModerateOpenShift Container Platform 3.11.374 bug fix and security update
- Red Hat OpenShift Container Platform 3.11 atomic-enterprise-service-catalog-1:3.11.374-1.git.1675.738abcc.el7, atomic-enterprise-service-catalog-svcat-1:3.11.374-1.git.1675.738abcc.el7, atomic-openshift-3.11.374-1.git.0.ebd3ee9.el7 +30
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2021:0079 |
Not affected: 3 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8554
- 2026-10-03 Alias added: GHSA-j9wf-vvm6-4r9w
- 2026-10-25 Priority changed: MEDIUM → LOW
References
Patch 3
Advisory 2
Other 12
- https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/
- [druid-commits] 20210201 [GitHub] [druid] jon-wei opened a new pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554
- [druid-commits] 20210202 [GitHub] [druid] jon-wei opened a new pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554
- [druid-commits] 20210203 [GitHub] [druid] jihoonson commented on pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554
- [druid-commits] 20210203 [GitHub] [druid] jihoonson merged pull request #10826: Address CVE-2020-8570, suppress CVE-2020-8554
- https://github.com/kubernetes/kubernetes/issues/97110
- https://lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b6@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb3@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@%3Ccommits.druid.apache.org%3E
- https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
- https://github.com/kubernetes/kubernetes
More Kubernetes vulnerabilities
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
Sources
- CVE-2020-8554 · CVE Program
- CVE-2020-8554 · NVD
- FIRST EPSS
- GHSA-j9wf-vvm6-4r9w · GitHub Advisory Database · CC BY 4.0
- CVE-2020-8554 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences