Read the docs
TI-2020-06863 Aliases CVE-2020-8565GHSA-8cfg-vx93-jvxw

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

Priority LOW 25CWE-532Published · Updated

Key facts

Attack vector
Local
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Partial Red Hat: 3 fixed, 3 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-532.

Summary

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

Why it matters now

EPSS 0.00518 44th percentileScored 2026-11-07
Fix Partial Kubernetes (Kubernetes): 1.20.0-alpha2k8s.io/client-go (Go): 0.19.6, 0.20.0-alpha.2, 0.18.14 +1+1 more productRed Hat: 3 advisoriesRed Hat: 3 fixed, 3 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
KubernetesKubernetesup to 1.19.3; up to 1.18.10; up to 1.17.13; before 1.20.0-alpha21.20.0-alpha2Patch availableCNA
—k8s.io/client-go (Go)0.19.0 to before 0.19.60.19.6Patch availableGHSA-8cfg-vx93-jvxw
—k8s.io/client-go (Go)0.20.0-alpha.0 to before 0.20.0-alpha.20.20.0-alpha.2Patch availableGHSA-8cfg-vx93-jvxw
—k8s.io/client-go (Go)0.18.0 to before 0.18.140.18.14Patch availableGHSA-8cfg-vx93-jvxw
—k8s.io/client-go (Go)before 0.17.160.17.16Patch availableGHSA-8cfg-vx93-jvxw
—k8s.io/kubernetes (Go)before 1.20.0-alpha.21.20.0-alpha.2Patch availableGHSA-8cfg-vx93-jvxw
  • Kubernetes VendorKubernetes Affected up to 1.19.3; up to 1.18.10; up to 1.17.13; before 1.20.0-alpha2 Fixed in 1.20.0-alpha2 Patch available CNA
  • k8s.io/client-go (Go) Vendor— Affected 0.19.0 to before 0.19.6 Fixed in 0.19.6 Patch available GHSA-8cfg-vx93-jvxw
  • k8s.io/client-go (Go) Vendor— Affected 0.20.0-alpha.0 to before 0.20.0-alpha.2 Fixed in 0.20.0-alpha.2 Patch available GHSA-8cfg-vx93-jvxw
  • k8s.io/client-go (Go) Vendor— Affected 0.18.0 to before 0.18.14 Fixed in 0.18.14 Patch available GHSA-8cfg-vx93-jvxw
  • k8s.io/client-go (Go) Vendor— Affected before 0.17.16 Fixed in 0.17.16 Patch available GHSA-8cfg-vx93-jvxw
  • k8s.io/kubernetes (Go) Vendor— Affected before 1.20.0-alpha.2 Fixed in 1.20.0-alpha.2 Patch available GHSA-8cfg-vx93-jvxw

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*1.17.0 – 1.17.13; 1.18.0 – 1.18.10; 1.19.0 – 1.19.3VulnerableKubernetes
  • cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* Versions 1.17.0 – 1.17.13; 1.18.0 – 1.18.10; 1.19.0 – 1.19.3 Vulnerable ·Kubernetes

Remediation

  • Fix · CNA Kubernetes (Kubernetes) Fixed in 1.20.0-alpha2
  • Fix · GHSA-8cfg-vx93-jvxw k8s.io/client-go (Go) Fixed in 0.19.6 Advisory →
  • Fix · GHSA-8cfg-vx93-jvxw k8s.io/client-go (Go) Fixed in 0.20.0-alpha.2 Advisory →
  • Fix · GHSA-8cfg-vx93-jvxw k8s.io/client-go (Go) Fixed in 0.18.14 Advisory →
  • Fix · GHSA-8cfg-vx93-jvxw k8s.io/client-go (Go) Fixed in 0.17.16 Advisory →
  • Fix · GHSA-8cfg-vx93-jvxw k8s.io/kubernetes (Go) Fixed in 1.20.0-alpha.2 Advisory →

Red Hat 3 advisories

  • RHSA-2021:5086 Released 2021-12-13 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update
    • Red Hat OpenShift Data Foundation 4.9 on RHEL-8 odf/odf-multicluster-rhel8-operator, odf4/cephcsi-rhel8, odf4/ocs-must-gather-rhel8 +12
  • RHSA-2021:5085 Released 2021-12-13 · Red Hat rating Moderate
    Red Hat OpenShift Data Foundation 4.9.0 enhancement, security, and bug fix update
    • Red Hat OpenShift Data Foundation 4.9 on RHEL-8 mcg-5.9.0-28.61dcf87.5.9.el8
  • RHSA-2021:2041 Released 2021-05-19 · Red Hat rating Moderate
    Red Hat OpenShift Container Storage 4.7.0 security, bug fix, and enhancement update
    • Red Hat OpenShift Container Storage 4.7 on RHEL-8 ocs4/mcg-core-rhel8, ocs4/mcg-rhel8-operator, ocs4/rook-ceph-rhel8-operator

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Will not fix
Red Hat Openshift Container Storage 4AffectedNo fix yet
Red Hat Storage 3AffectedNo fix planned: Will not fix
Red Hat OpenShift Container Storage 4.7 on RHEL-8Fixed RHSA-2021:2041
Red Hat OpenShift Container Storage 4.8 on RHEL-8Fixed—
Red Hat OpenShift Data Foundation 4.9 on RHEL-8Fixed RHSA-2021:5085, RHSA-2021:5086
Not affected: 2 products
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Container Storage 4.7 on RHEL-8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-8565
  2. 2026-10-03 Alias added: GHSA-8cfg-vx93-jvxw

References

Patch 1

Advisory 2

Other 8

  • TI-2018-16130 Improper privilege management in Kubernetes CVSS 3.0CRITICAL 9.8
  • TI-2019-08418 Kubernetes kubelet exposes /debug/pprof info on healthz port CVSS 3.1HIGH 8.2
  • TI-2023-05086 Kubernetes - Windows nodes - Insufficient input sanitization in in-tree storage plugin leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-03433 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation CVSS 3.1HIGH 8.8
  • TI-2023-02285 Bypass of seccomp profile enforcement CVSS 3.1MEDIUM 5.5
  • TI-2017-14755 Link following in Kubernetes CVSS 3.0CRITICAL 9.6
See all 55 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences