Database/Container, Kubernetes & orchestration

Kubernetes (kube-apiserver): Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to other

CVSS 6.4CVE-2020-8559Container, Kubernetes & orchestrationcurated

Impact

Unvalidated redirect on proxied upgrade requests lets a compromised node escalate to other nodes

Who can reach it

An attacker who already owns one node, pivoting cluster-wide

What to do

Rolling control-plane upgrade; no GPU drain

References

https://nvd.nist.gov/vuln/detail/CVE-2020-8559

Related entries

Kubernetes (kube-apiserver): Any user who can create a Service with externalIPs (or patch LB status) intercepts clusterCVE-2020-8554 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Successful API requests can DoS the apiserverCVE-2020-8552 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Aggregated API server can redirect apiserver clientsCVE-2022-3172 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): Admission webhook responses redirect apiserver requests into private networksCVE-2020-8561 · Kubernetes (kube-apiserver)Medium
Kubernetes (kube-apiserver): NetworkPolicy is not applied during a race in namespace termination, so pods briefly runCVE-2024-7598 · Kubernetes (kube-apiserver)Low
Kubernetes (kube-apiserver): Init/ephemeral container envFrom bypasses the ServiceAccount mountable-secrets policyCVE-2024-3177 · Kubernetes (kube-apiserver)Low

All Container, Kubernetes & orchestration entries

This entry is curated: imported from vendor advisories with machine assistance, not yet individually verified. Confirm against your vendor's advisory before acting, and report anything wrong.