Kubernetes node setting allows for neighboring hosts to bypass localhost boundary
Priority MEDIUM 44CWE-420Published · Updated
Key facts
- Attack vector
- Adjacent network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.
Why it matters now
EPSS 0.03418 88th percentileScored 2026-11-07
Public exploit Yes 2 exploit referencesTagged by NVD
Fix Fixed Kubernetes (Kubernetes): 1.18.4, 1.17.7, 1.16.11k8s.io/kubernetes (Go): 1.18.4, 1.17.7, 1.16.11Red Hat: 7 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | Kubernetes | before 1.18.4; before 1.17.7; before 1.16.11; 1.15; 1.14; 1.13; 1.12; 1.11; 1.10; 1.9; 1.8; 1.7; 1.6; 1.5; 1.4; 1.3; 1.2; 1.1 | 1.18.4, 1.17.7, 1.16.11 | Patch available | CNA |
| — | k8s.io/kubernetes (Go) | 1.18.0 to before 1.18.4 | 1.18.4 | Patch available | GHSA-wqv3-8cm6-h6wg |
| — | k8s.io/kubernetes (Go) | 1.17.0 to before 1.17.7 | 1.17.7 | Patch available | GHSA-wqv3-8cm6-h6wg |
| — | k8s.io/kubernetes (Go) | before 1.16.11 | 1.16.11 | Patch available | GHSA-wqv3-8cm6-h6wg |
- Kubernetes VendorKubernetes Affected before 1.18.4; before 1.17.7; before 1.16.11; 1.15; 1.14; 1.13; 1.12; 1.11; 1.10; 1.9; 1.8; 1.7; 1.6; 1.5; 1.4; 1.3; 1.2; 1.1 Fixed in 1.18.4, 1.17.7, 1.16.11 Patch available CNA
- k8s.io/kubernetes (Go) Vendor— Affected 1.18.0 to before 1.18.4 Fixed in 1.18.4 Patch available GHSA-wqv3-8cm6-h6wg
- k8s.io/kubernetes (Go) Vendor— Affected 1.17.0 to before 1.17.7 Fixed in 1.17.7 Patch available GHSA-wqv3-8cm6-h6wg
- k8s.io/kubernetes (Go) Vendor— Affected before 1.16.11 Fixed in 1.16.11 Patch available GHSA-wqv3-8cm6-h6wg
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | 1.1.0 – 1.16.10; 1.17.0 – 1.17.6; 1.18.0 – 1.18.3 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions 1.1.0 – 1.16.10; 1.17.0 – 1.17.6; 1.18.0 – 1.18.3 Vulnerable ·Kubernetes
Remediation
- Fix · CNA Kubernetes (Kubernetes) Fixed in 1.18.4, 1.17.7, 1.16.11
- Fix · GHSA-wqv3-8cm6-h6wg k8s.io/kubernetes (Go) Fixed in 1.18.4 Advisory →
- Fix · GHSA-wqv3-8cm6-h6wg k8s.io/kubernetes (Go) Fixed in 1.17.7 Advisory →
- Fix · GHSA-wqv3-8cm6-h6wg k8s.io/kubernetes (Go) Fixed in 1.16.11 Advisory →
Red Hat 7 advisories
- RHSA-2020:3184 Released 2020-08-05 · Red Hat rating ModerateOpenShift Container Platform 4.3.31 openshift-enterprise-hyperkube-container security update
- Red Hat OpenShift Container Platform 4.3 openshift4/ose-hyperkube
- RHSA-2020:3183 Released 2020-08-05 · Red Hat rating ModerateOpenShift Container Platform 4.3.31 openshift security update
- Red Hat OpenShift Container Platform 4.3 openshift-4.3.31-202007280738.p0.git.0.9884401.el7, openshift-4.3.31-202007280738.p0.git.0.9884401.el8, openshift-hyperkube-4.3.31-202007280738.p0.git.0.9884401.el7 +1
- RHSA-2020:2992 Released 2020-07-27 · Red Hat rating ModerateOpenShift Container Platform 3.11 security update
- Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients-3.11.248-1.git.0.92ee8ac.el7, atomic-openshift-clients-redistributable-3.11.248-1.git.0.92ee8ac.el7 +12
Show 4 more Red Hat advisories
- RHSA-2020:2926 Released 2020-07-21 · Red Hat rating ModerateOpenShift Container Platform 4.4.13 openshift-enterprise-hyperkube-container security update
- Red Hat OpenShift Container Platform 4.4 openshift4/ose-hyperkube
- RHSA-2020:2927 Released 2020-07-21 · Red Hat rating ModerateOpenShift Container Platform 4.4.13 machine-config-daemon and openshift security update
- Red Hat OpenShift Container Platform 4.4 machine-config-daemon-4.4.0-202007092124.p0.git.2349.08d34d1.el8, openshift-4.4.0-202007090832.p0.git.0.bc32fb1.el7, openshift-4.4.0-202007090832.p0.git.0.bc32fb1.el8 +2
- RHSA-2020:2412 Released 2020-07-13 · Red Hat rating ModerateOpenShift Container Platform 4.5 container image security update
- Red Hat OpenShift Container Platform 4.5 openshift4/ose-cluster-logging-operator, openshift4/ose-console, openshift4/ose-hyperkube +2
- RHSA-2020:2413 Released 2020-07-13 · Red Hat rating ModerateOpenShift Container Platform 4.5 package security update
- Red Hat OpenShift Container Platform 4.5 machine-config-daemon-4.5.0-202007012112.p0.git.2527.d12c3da.el8, openshift-4.5.0-202007012112.p0.git.0.582d7fc.el7, openshift-4.5.0-202007012112.p0.git.0.582d7fc.el8 +2
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2020:2992 |
| Red Hat OpenShift Container Platform 4.3 | Fixed | RHSA-2020:3183, RHSA-2020:3184 |
| Red Hat OpenShift Container Platform 4.4 | Fixed | RHSA-2020:2926, RHSA-2020:2927 |
| Red Hat OpenShift Container Platform 4.5 | Fixed | RHSA-2020:2412, RHSA-2020:2413 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | — |
Not affected: 4 products
- Red Hat OpenShift Container Platform 3.11
- Red Hat OpenShift Container Platform 4.4
- Red Hat OpenShift Container Platform 4.5
- Red Hat Storage 3
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8558
- 2026-10-03 Alias added: GHSA-wqv3-8cm6-h6wg
- 2026-10-30 Fix available: Red Hat OpenShift Container Platform 4.6 · Red Hat
References
Exploit 2
Advisory 2
Other 9
- https://github.com/bottlerocket-os/bottlerocket/security/advisories/GHSA-wqv3-8cm6-h6wg
- https://bugzilla.redhat.com/show_bug.cgi?id=1843358
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8558
- https://github.com/kubernetes/kubernetes
- https://github.com/tabbysable/POC-2020-8558
- https://groups.google.com/g/kubernetes-security-announce/c/B1VegbBDMTE
- https://labs.bishopfox.com/tech-blog/bad-pods-kubernetes-pod-privilege-escalation
- https://security.netapp.com/advisory/ntap-20200821-0001
- https://www.openwall.com/lists/oss-security/2020/07/08/1
More Kubernetes vulnerabilities
- TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
- TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
- TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
- TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
- TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
Sources
- CVE-2020-8558 · CVE Program
- CVE-2020-8558 · NVD
- FIRST EPSS
- GHSA-wqv3-8cm6-h6wg · GitHub Advisory Database · CC BY 4.0
- CVE-2020-8558 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences