CVE-2020-8561 Webhook redirect in kube-apiserver
Attackers controlling webhook responses can redirect API server requests to private networks, potentially exposing sensitive data in logs if verbose logging is enabled.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-8561?
CVE-2020-8561 is a medium-severity server-side request forgery vulnerability in Kubernetes Kubernetes, published on 20 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Which versions are affected by CVE-2020-8561?
2 open source packages ship an affected version, including k8s.io/kubernetes. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
k8s.io/kubernetes Go | All versions to 1.22.2 | None |
k8s.io/kubernetes Go | All versions to 1.22.2 | None |
Linux distribution packages (4)
kubernetes1.33 openSUSE:Tumbleweed | All versions | 1.33.13-2.1 |
kubernetes1.34 openSUSE:Tumbleweed | All versions | 1.34.10-1.1 |
kubernetes1.35 openSUSE:Tumbleweed | All versions | 1.35.7-1.1 |
kubernetes1.36 openSUSE:Tumbleweed | All versions | 1.36.3-1.1 |
Products include Kubernetes Kubernetes.
How do I fix CVE-2020-8561?
Upgrade to a fixed version.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2020-8561 being exploited?
There is no known exploitation of CVE-2020-8561 in the wild and no public exploit code.
Other vulnerabilities in Kubernetes Kubernetes
- CVE-2018-1002105 Privilege Escalation in Kubernetes
- CVE-2017-1000056 Kubernetes Privilege Escalation
- CVE-2016-1906 Authorization bypass in Openshift
- CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
- CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation
Sources
Also known as AZL-89315, DEBIAN-CVE-2020-8561, GHSA-74j8-88mm-7496, openSUSE-SU-2026:11388-1, openSUSE-SU-2026:11389-1, openSUSE-SU-2026:11390-1 and 1 more.