Kubernetes kube-controller-manager SSRF
Priority LOW 34CWE-918Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- High
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Partial Red Hat: 6 fixed, 1 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-918 and the CVSS impact.
Summary
The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).
Why it matters now
EPSS 0.03679 89th percentileScored 2026-11-07
Fix Partial Kubernetes (Kubernetes): 1.15.12, 1.16.9, 1.17.5k8s.io/kubernetes (Go): 1.18.1, 1.17.4, 1.16.9 +1Red Hat: 6 advisoriesRed Hat: 6 fixed, 1 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | 1.18.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15 to before 1.15.12; 1.16 to before 1.16.9; 1.17 to before 1.17.5 | 1.15.12, 1.16.9, 1.17.5 | Patch available | CNA |
| — | k8s.io/kubernetes (Go) | 1.18.0 to before 1.18.1 | 1.18.1 | Patch available | GHSA-x6mj-w4jf-jmgw |
| — | k8s.io/kubernetes (Go) | 1.17.0 to before 1.17.4 | 1.17.4 | Patch available | GHSA-x6mj-w4jf-jmgw |
| — | k8s.io/kubernetes (Go) | 1.16.0 to before 1.16.9 | 1.16.9 | Patch available | GHSA-x6mj-w4jf-jmgw |
| — | k8s.io/kubernetes (Go) | before 1.15.12 | 1.15.12 | Patch available | GHSA-x6mj-w4jf-jmgw |
- Kubernetes VendorKubernetes Affected 1.18.0; 1.1; 1.2; 1.3; 1.4; 1.5; 1.6; 1.7; 1.8; 1.9; 1.10; 1.11; 1.12; 1.13; 1.14; 1.15 to before 1.15.12; 1.16 to before 1.16.9; 1.17 to before 1.17.5 Fixed in 1.15.12, 1.16.9, 1.17.5 Patch available CNA
- k8s.io/kubernetes (Go) Vendor— Affected 1.18.0 to before 1.18.1 Fixed in 1.18.1 Patch available GHSA-x6mj-w4jf-jmgw
- k8s.io/kubernetes (Go) Vendor— Affected 1.17.0 to before 1.17.4 Fixed in 1.17.4 Patch available GHSA-x6mj-w4jf-jmgw
- k8s.io/kubernetes (Go) Vendor— Affected 1.16.0 to before 1.16.9 Fixed in 1.16.9 Patch available GHSA-x6mj-w4jf-jmgw
- k8s.io/kubernetes (Go) Vendor— Affected before 1.15.12 Fixed in 1.15.12 Patch available GHSA-x6mj-w4jf-jmgw
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | before 1.15.11; 1.16.0 to before 1.16.9; 1.17.0 to before 1.17.5 | Vulnerable | Kubernetes |
| cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:* | 1.18.0 | Vulnerable | Kubernetes |
| cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* | 32 | Vulnerable | Fedoraproject |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions before 1.15.11; 1.16.0 to before 1.16.9; 1.17.0 to before 1.17.5 Vulnerable ·Kubernetes
- cpe:2.3:a:kubernetes:kubernetes:1.18.0:-:*:*:*:*:*:* Versions 1.18.0 Vulnerable ·Kubernetes
- cpe:2.3:o:fedoraproject:fedora:32:*:*:*:*:*:*:* Versions 32 Vulnerable ·Fedoraproject
Remediation
- Fix · CNA Kubernetes (Kubernetes) Fixed in 1.15.12, 1.16.9, 1.17.5
- Fix · GHSA-x6mj-w4jf-jmgw k8s.io/kubernetes (Go) Fixed in 1.18.1 Advisory →
- Fix · GHSA-x6mj-w4jf-jmgw k8s.io/kubernetes (Go) Fixed in 1.17.4 Advisory →
- Fix · GHSA-x6mj-w4jf-jmgw k8s.io/kubernetes (Go) Fixed in 1.16.9 Advisory →
- Fix · GHSA-x6mj-w4jf-jmgw k8s.io/kubernetes (Go) Fixed in 1.15.12 Advisory →
Red Hat 6 advisories
- RHSA-2020:2594 Released 2020-07-01 · Red Hat rating ModerateOpenShift Container Platform 4.2.36 openshift security update
- Red Hat OpenShift Container Platform 4.2 openshift-4.2.36-202006211650.p0.git.0.1fe246f.el7, openshift-4.2.36-202006211650.p0.git.0.1fe246f.el8, openshift-hyperkube-4.2.36-202006211650.p0.git.0.1fe246f.el7 +1
- RHSA-2020:2479 Released 2020-06-18 · Red Hat rating ModerateOpenShift Container Platform 3.11 atomic-openshift security update
- Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.232-1.git.0.a5bc32f.el7, atomic-openshift-clients-3.11.232-1.git.0.a5bc32f.el7, atomic-openshift-clients-redistributable-3.11.232-1.git.0.a5bc32f.el7 +10
- RHSA-2020:2449 Released 2020-06-17 · Red Hat rating ModerateOpenShift Container Platform 4.4.8 openshift-enterprise-hyperkube-container security update
- Red Hat OpenShift Container Platform 4.4 openshift4/ose-hyperkube
Show 3 more Red Hat advisories
- RHSA-2020:2448 Released 2020-06-17 · Red Hat rating ModerateOpenShift Container Platform 4.4.8 openshift security update
- Red Hat OpenShift Container Platform 4.4 openshift-4.4.0-202006061254.git.1.dc84fb4.el7, openshift-4.4.0-202006061254.git.1.dc84fb4.el8, openshift-hyperkube-4.4.0-202006061254.git.1.dc84fb4.el7 +1
- RHSA-2020:2441 Released 2020-06-17 · Red Hat rating ModerateOpenShift Container Platform 4.3.25 openshift-enterprise-hyperkube-container security update
- Red Hat OpenShift Container Platform 4.3 openshift4/ose-hyperkube
- RHSA-2020:2440 Released 2020-06-17 · Red Hat rating ModerateOpenShift Container Platform 4.3.25 openshift security update
- Red Hat OpenShift Container Platform 4.3 openshift-4.3.25-202006060952.git.1.96c30f6.el7, openshift-4.3.25-202006060952.git.1.96c30f6.el8, openshift-hyperkube-4.3.25-202006060952.git.1.96c30f6.el7 +1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Storage 3 | Affected | No fix yet: Fix deferred |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2020:2479 |
| Red Hat OpenShift Container Platform 4.2 | Fixed | RHSA-2020:2594 |
| Red Hat OpenShift Container Platform 4.3 | Fixed | RHSA-2020:2440, RHSA-2020:2441 |
| Red Hat OpenShift Container Platform 4.4 | Fixed | RHSA-2020:2448, RHSA-2020:2449 |
| Red Hat OpenShift Container Platform 4.5 | Fixed | — |
| Red Hat OpenShift Container Platform 4.6 | Fixed | — |
Not affected: 1 product
- Red Hat Openshift Container Storage 4
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8555
- 2026-10-03 Alias added: GHSA-x6mj-w4jf-jmgw
- 2026-10-30 Fix available: Red Hat OpenShift Container Platform 4.5, Red Hat OpenShift Container Platform 4.6 · Red Hat
References
Advisory 7
- [oss-security] 20200601 CVE-2020-8555: Kubernetes: Half-Blind SSRF in kube-controller-manager
- https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussion
- https://github.com/kubernetes/kubernetes/issues/91542
- FEDORA-2020-aeea04cd13
- https://security.netapp.com/advisory/ntap-20200724-0005/
- [oss-security] 20210504 [kubernetes] CVE-2020-8562: Bypass of Kubernetes API Server proxy TOCTOU
- https://nvd.nist.gov/vuln/detail/CVE-2020-8555
More Kubernetes vulnerabilities
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
Sources
- CVE-2020-8555 · CVE Program
- CVE-2020-8555 · NVD
- FIRST EPSS
- GHSA-x6mj-w4jf-jmgw · GitHub Advisory Database · CC BY 4.0
- CVE-2020-8555 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences