CVE-2020-8565 Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

What is CVE-2020-8565?

CVE-2020-8565 is a medium-severity vulnerability in Kubernetes Kubernetes, published on 7 Dec 2020. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.

Weakness: CWE-532

Which versions are affected by CVE-2020-8565?

11 open source packages ship an affected version, including k8s.io/kubernetes and k8s.io/client-go. It affects 1 product.

Products include Kubernetes Kubernetes.

How do I fix CVE-2020-8565?

Upgrade k8s.io/kubernetes to 1.20.0-alpha.2 or later.

Is CVE-2020-8565 being exploited?

There is no known exploitation of CVE-2020-8565 in the wild and no public exploit code.

Other vulnerabilities in Kubernetes Kubernetes

• CVE-2018-1002105 Privilege Escalation in Kubernetes Critical 9.8
• CVE-2017-1000056 Kubernetes Privilege Escalation Critical 9.8
• CVE-2016-1906 Authorization bypass in Openshift Critical 9.8
• CVE-2023-3676 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation High 8.8
• CVE-2023-3955 Kubernetes - Windows nodes - Insufficient input sanitization leads to privilege escalation High 8.8

All Kubernetes Kubernetes vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as AZL-41878, CLEANSTART-2025-JF58630, CLEANSTART-2026-AY16638, DEBIAN-CVE-2020-8565, GHSA-8cfg-vx93-jvxw, GO-2021-0064.