Read the docs
TI-2020-06862 Aliases CVE-2020-8564GHSA-8mjg-8c8g-6h85

Docker config secrets leaked when file is malformed and loglevel >= 4

Priority LOW 25CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

In Kubernetes clusters using a logging level of at least 4, processing a malformed docker config file will result in the contents of the docker config file being leaked, which can include pull secrets or other registry credentials. This affects < v1.19.3, < v1.18.10, < v1.17.13.

Why it matters now

EPSS 0.00467 40th percentileScored 2026-11-07
Fix Fixed Kubernetes (Kubernetes): 1.19.3, 1.18.10, 1.17.13github.com/kubernetes/kubernetes (Go): 1.19.3, 1.18.10, 1.17.13+1 more productRed Hat: 7 advisories

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesbefore 1.19.3; before 1.18.10; before 1.17.131.19.3, 1.18.10, 1.17.13Patch availableCNA
—github.com/kubernetes/kubernetes (Go)1.19.0 to before 1.19.31.19.3Patch availableGHSA-8mjg-8c8g-6h85
—github.com/kubernetes/kubernetes (Go)1.18.0 to before 1.18.101.18.10Patch availableGHSA-8mjg-8c8g-6h85
—github.com/kubernetes/kubernetes (Go)before 1.17.131.17.13Patch availableGHSA-8mjg-8c8g-6h85
—k8s.io/kubernetes (Go)before 1.20.0-alpha.11.20.0-alpha.1Patch availableGHSA-8mjg-8c8g-6h85
  • Kubernetes VendorKubernetes Affected before 1.19.3; before 1.18.10; before 1.17.13 Fixed in 1.19.3, 1.18.10, 1.17.13 Patch available CNA
  • github.com/kubernetes/kubernetes (Go) Vendor— Affected 1.19.0 to before 1.19.3 Fixed in 1.19.3 Patch available GHSA-8mjg-8c8g-6h85
  • github.com/kubernetes/kubernetes (Go) Vendor— Affected 1.18.0 to before 1.18.10 Fixed in 1.18.10 Patch available GHSA-8mjg-8c8g-6h85
  • github.com/kubernetes/kubernetes (Go) Vendor— Affected before 1.17.13 Fixed in 1.17.13 Patch available GHSA-8mjg-8c8g-6h85
  • k8s.io/kubernetes (Go) Vendor— Affected before 1.20.0-alpha.1 Fixed in 1.20.0-alpha.1 Patch available GHSA-8mjg-8c8g-6h85

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*1.17.0 to before 1.17.13; 1.18.0 to before 1.18.10; 1.19.0 to before 1.19.3VulnerableKubernetes
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions 1.17.0 to before 1.17.13; 1.18.0 to before 1.18.10; 1.19.0 to before 1.19.3 Vulnerable ·Kubernetes

Remediation

  • Fix · CNA Kubernetes (Kubernetes) Fixed in 1.19.3, 1.18.10, 1.17.13
  • Fix · GHSA-8mjg-8c8g-6h85 github.com/kubernetes/kubernetes (Go) Fixed in 1.19.3 Advisory →
  • Fix · GHSA-8mjg-8c8g-6h85 github.com/kubernetes/kubernetes (Go) Fixed in 1.18.10 Advisory →
  • Fix · GHSA-8mjg-8c8g-6h85 github.com/kubernetes/kubernetes (Go) Fixed in 1.17.13 Advisory →
  • Fix · GHSA-8mjg-8c8g-6h85 k8s.io/kubernetes (Go) Fixed in 1.20.0-alpha.1 Advisory →

Red Hat 7 advisories

  • RHSA-2021:3193 Released 2021-08-25 · Red Hat rating Moderate
    OpenShift Container Platform 3.11.z security and bug fix update
    • Red Hat OpenShift Container Platform 3.11 atomic-openshift-3.11.501-1.git.0.f8c4746.el7, atomic-openshift-clients-3.11.501-1.git.0.f8c4746.el7, atomic-openshift-clients-redistributable-3.11.501-1.git.0.f8c4746.el7 +10
  • RHSA-2021:0281 Released 2021-02-03 · Red Hat rating Important
    OpenShift Container Platform 4.4.33 bug fix and security update
    • Red Hat OpenShift Container Platform 4.4 openshift4/ose-aws-machine-controllers, openshift4/ose-azure-machine-controllers, openshift4/ose-baremetal-machine-controllers +47
  • RHSA-2021:0171 Released 2021-01-25 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.13 bug fix and security update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-hyperkube
Show 4 more Red Hat advisories
  • RHSA-2021:0172 Released 2021-01-25 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.13 packages and security update
    • Red Hat OpenShift Container Platform 4.6 containers-common-1:1.1.1-3.rhaos4.6.el8, openshift-4.6.0-202101160934.p0.git.94242.fc5242e.el7, openshift-4.6.0-202101160934.p0.git.94242.fc5242e.el8 +4
  • RHSA-2020:5359 Released 2020-12-15 · Red Hat rating Moderate
    OpenShift Container Platform 4.5.23 security and bug fix update
    • Red Hat OpenShift Container Platform 4.5 openshift4/ose-docker-builder
  • RHSA-2020:5259 Released 2020-12-14 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.8 security and bug fix update
    • Red Hat OpenShift Container Platform 4.6 openshift4/ose-docker-builder
  • RHSA-2020:4297 Released 2020-10-27 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.1 package security update
    • Red Hat OpenShift Container Platform 4.6 containers-common-1:1.1.1-2.rhaos4.6.el8, jenkins-2-plugins-4.6.1601368321-1.el8, openshift-clients-4.6.0-202010081244.p0.git.3794.4743d24.el7 +11

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:3193
Red Hat OpenShift Container Platform 4.4Fixed RHSA-2021:0281
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2020:5359
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2020:4297, RHSA-2020:5259, RHSA-2021:0171, RHSA-2021:0172
Not affected: 5 products
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.4
  • Red Hat OpenShift Container Platform 4.5
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Storage 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8564
  2. 2026-10-03 Alias added: GHSA-8mjg-8c8g-6h85

References

Patch 1

Advisory 3

Other 5

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
  • TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences