Kubernetes CSI snapshot-controller DoS
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-476.
Summary
Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected.
Why it matters now
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Kubernetes | CSI Snapshotter | snapshot-controller v3.0 – v3.0.1; snapshot-controller v2.1 – v2.1.2 | — | No fix listed | CNA |
| — | github.com/kubernetes-csi/external-snapshotter/v2 (Go) | 2.0.0 to before 2.1.3 | 2.1.3 | Patch available | GHSA-hwrr-rhmm-vcvf |
| — | github.com/kubernetes-csi/external-snapshotter/v3 (Go) | 3.0.0 to before 3.0.2 | 3.0.2 | Patch available | GHSA-hwrr-rhmm-vcvf |
- CSI Snapshotter VendorKubernetes Affected snapshot-controller v3.0 – v3.0.1; snapshot-controller v2.1 – v2.1.2 Fixed in — No fix listed CNA
- github.com/kubernetes-csi/external-snapshotter/v2 (Go) Vendor— Affected 2.0.0 to before 2.1.3 Fixed in 2.1.3 Patch available GHSA-hwrr-rhmm-vcvf
- github.com/kubernetes-csi/external-snapshotter/v3 (Go) Vendor— Affected 3.0.0 to before 3.0.2 Fixed in 3.0.2 Patch available GHSA-hwrr-rhmm-vcvf
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:kubernetes:container_storage_interface_snapshotter:*:*:*:*:*:*:*:* | 2.1.0 to before 2.1.3; 3.0.0 to before 3.0.2 | Vulnerable | Kubernetes |
- cpe:2.3:a:kubernetes:container_storage_interface_snapshotter:*:*:*:*:*:*:*:* Versions 2.1.0 to before 2.1.3; 3.0.0 to before 3.0.2 Vulnerable ·Kubernetes
Remediation
- Fix · GHSA-hwrr-rhmm-vcvf github.com/kubernetes-csi/external-snapshotter/v2 (Go) Fixed in 2.1.3 Advisory →
- Fix · GHSA-hwrr-rhmm-vcvf github.com/kubernetes-csi/external-snapshotter/v3 (Go) Fixed in 3.0.2 Advisory →
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
Not affected: 2 products
- Red Hat OpenShift Container Platform 4
- Red Hat OpenShift Virtualization 2
Timeline
- 2026-10-02 Threatist record created from CVE-2020-8569
- 2026-10-03 Alias added: GHSA-hwrr-rhmm-vcvf
References
Sources
- CVE-2020-8569 · CVE Program
- CVE-2020-8569 · NVD
- FIRST EPSS
- GHSA-hwrr-rhmm-vcvf · GitHub Advisory Database · CC BY 4.0
- CVE-2020-8569 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences