Skip to content
Fencer Vulns
medium 6.4

CVE-2020-8559 json

Privilege escalation from compromised node to cluster

published 2020-07-22 6 y ago modified 2026-09-10 1 mo ago also GHSA-33c5-9fx5-fvjm , GO-2024-2748 , EUVD-2024-1072

cvss
6.4
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
6.1%
EPSS 6.1% chance of exploitation in 30 days, percentile 93%
public exploits
0
none known

Summary

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

Patch / fix

  • go k8s.io/apimachinery 0.16.13, 0.17.9, 0.18.7, 0.18.7-rc.0
  • go k8s.io/kubernetes 1.16.13, 1.17.9, 1.18.7
  • kubernetes kubernetes 1.16.13, 1.17.9, 1.18.6
  • kubernetes Debian 14, Debian 13, Debian 12 1.18.5-1

debian advisories DEBIAN-CVE-2020-8559

  • openshift openshift 4.4 4.4.0-202012052258.p0.git.0.0fd57a4.el7
  • openshift openshift 4.4 4.4.0-202012052258.p0.git.0.0fd57a4.el8
  • openshift-hyperkube openshift 4.4 4.4.0-202012052258.p0.git.0.0fd57a4.el7
  • openshift-hyperkube openshift 4.4 4.4.0-202012052258.p0.git.0.0fd57a4.el8
  • atomic-openshift openshift 3.11 3.11.346-1.git.0.ea10721.el7
  • atomic-openshift-pod openshift 3.11 3.11.346-1.git.0.ea10721.el7
  • atomic-openshift-node openshift 3.11 3.11.346-1.git.0.ea10721.el7
  • atomic-openshift-tests openshift 3.11 3.11.346-1.git.0.ea10721.el7

red hat advisories RHSA-2021:0030RHSA-2020:5363RHBA-2020:4197

  • k3s Alpine 3.24, Alpine 3.23, Alpine 3.22 +9 more 1.18.6.1-r0

alpine advisories ALPINE-CVE-2020-8559

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-8559 updated cvss 6.4

kubernetes: compromised node could escalate to cluster level privileges

  • Red Hat OpenShift Container Platform 3.11 atomic-openshift 3.11.346-1.git.0.ea10721.el7, atomic-openshift-pod 3.11.346-1.git.0.ea10721.el7, atomic-openshift-node 3.11.346-1.git.0.ea10721.el7, atomic-openshift-tests 3.11.346-1.git.0.ea10721.el7, atomic-openshift-master 3.11.346-1.git.0.ea10721.el7, atomic-openshift-clients 3.11.346-1.git.0.ea10721.el7, +7 more
    fixed: vendor fix “No mitigation is known.” RHSA-2020:5363
  • Red Hat OpenShift Container Platform 4.4 openshift4/ose-hyperkube v4.4.0-202101261542.p0, openshift 4.4.0-202012052258.p0.git.0.0fd57a4.el7, openshift 4.4.0-202012052258.p0.git.0.0fd57a4.el8, openshift-hyperkube 4.4.0-202012052258.p0.git.0.0fd57a4.el7, openshift-hyperkube 4.4.0-202012052258.p0.git.0.0fd57a4.el8
    fixed: vendor fix “No mitigation is known.” RHSA-2021:0030
  • Red Hat OpenShift Container Platform 4.5 openshift4/ose-hyperkube v4.5.0-202011211036.p0
    fixed: vendor fix “No mitigation is known.” RHSA-2020:5194
  • Red Hat OpenShift Container Platform 4.6 openshift4/ose-hyperkube v4.6.0-202010081843.p0, openshift 4.6.0-202010022112.p0.git.94033.ef41184.el7, openshift 4.6.0-202010022112.p0.git.94033.ef41184.el8, openshift-hyperkube 4.6.0-202010022112.p0.git.94033.ef41184.el7, openshift-hyperkube 4.6.0-202010022112.p0.git.94033.ef41184.el8
    fixed: vendor fix “No mitigation is known.” RHBA-2020:4197
  • Red Hat OpenShift Container Platform 3.11 prometheus 3.11.346-1.git.5026.2eafa83.el7, openshift-ansible 3.11.346-1.git.0.f65cc70.el7, openshift-kuryr 3.11.346-1.git.1478.b99caab.el7, openshift-ansible-test 3.11.346-1.git.0.f65cc70.el7, openshift-kuryr-cni 3.11.346-1.git.1478.b99caab.el7, openshift-ansible-roles 3.11.346-1.git.0.f65cc70.el7, +21 more Red Hat OpenShift Container Platform 4 openshift4/ose-openshift-apiserver-rhel9 Red Hat OpenShift Container Platform 4.4 openshift4/ose-cli v4.4.0-202101261542.p0, openshift4/ose-pod v4.4.0-202101261542.p0, openshift4/ose-etcd v4.4.0-202101261542.p0, openshift4/ose-tests v4.4.0-202101261542.p0, openshift4/ose-console v4.4.0-202101261542.p0, openshift4/ose-coredns v4.4.0-202101261542.p0, +75 more Red Hat OpenShift Container Platform 4.5 openshift4/ose-tests v4.5.0-202011211036.p0, openshift4/ose-console v4.5.0-202011210215.p0, openshift4/ose-kube-proxy v4.5.0-202011180703.p0, openshift4/ose-ironic-rhel8 v4.5.0-202011210215.p0, openshift4/ose-kuryr-cni-rhel8 v4.5.0-202011180703.p0, openshift4/ose-operator-marketplace v4.5.0-202011202351.p0, +10 more Red Hat OpenShift Container Platform 4.6 jq 1.6-2.el7, jq 1.6-2.el8, faq 0.0.6-4.el8, ostree 2020.5-4.el8, pprof 2.6.3-2.el8+7, tini 0.16.1-1.el8ar, +353 more Red Hat OpenShift Container Platform 4.6 for System Z over RHEL 8 s390utils 2.6.0-28.el8_2.2, s390utils-base 2.6.0-28.el8_2.2, s390utils-cmsfs 2.6.0-28.el8_2.2, s390utils-zdsfs 2.6.0-28.el8_2.2, s390utils-ziomon 2.6.0-28.el8_2.2, s390utils-cpuplugd 2.6.0-28.el8_2.2, +6 more
    +1 more products
    Red Hat Storage 3 heketi, heketi-client, python-heketi
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

6.10% chance of exploitation in the next 30 days, higher than 93% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/kubernetes/kubernetes/issues/92914 referenced PoC, tagged "exploit" by a source, unverified
  • groups.google.com https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 6.4 CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H
NVD 3.1 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H
NVD 2.0 6.0 AV:N/AC:M/Au:S/C:P/I:P/A:P
GitHub 3.1 6.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H

Affected packages

ecosystem package affected fixed in
go k8s.io/apimachinery
<0.16.13
>=0.17.0, <0.17.9
>=0.18.0, <0.18.7
>=0.18.0, <0.18.7-rc.0
0.16.13
0.17.9
0.18.7
0.18.7-rc.0
go k8s.io/kubernetes
<1.16.13
>=1.17.0, <1.17.9
>=1.18.0, <1.18.7
1.16.13
1.17.9
1.18.7

Affected products

  • Kubernetes Kubernetes

Classification

Weakness
  • CWE-601 URL Redirection to Untrusted Site
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.