GHSA-j9wf-vvm6-4r9w CVE-2020-8554
Unverified Ownership in Kubernetes
- Severity
- 5.0 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 8.72%
- Chance of exploitation in the next 30 days. Higher than 95.14% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-283 Unverified Ownership
- Fix
- None yet
- No fixed version published
Description
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
Affected versions
Go
| Package | Vulnerable | Fixed in |
|---|---|---|
| k8s.io/kubernetes | <= 1.22.0 |
No fix yet |
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 5.0
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:L
- Attack vector
- Network
- Attack complexity
- High
- Privileges required
- Low
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- Low
- Integrity
- Low
- Availability
- Low
Weakness
CWE-283: Unverified Ownership
The product does not properly verify that a critical resource is owned by the proper entity.
How to prevent it
- Architecture and Design, Operation: Very carefully manage the setting, management, and handling of privileges. Explicitly manage trust zones in the software.
- Architecture and Design: Consider following the principle of separation of privilege. Require multiple conditions to be met before permitting access to a system resource.
References
Advisories
Packages
Other links
- github.com/kubernetes/kubernetes/issues/97076
- github.com/kubernetes/kubernetes/issues/97110
- oracle.com/security-alerts/cpujan2022.html
- oracle.com/security-alerts/cpuapr2022.html
- oracle.com//security-alerts/cpujul2021.html
- lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b…
- lists.apache.org/thread.html/rdb223e1b82e3d7d8e4eaddce8dd1ab87252e3935cc41c859f49767b…
- lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb…
- lists.apache.org/thread.html/rcafa485d63550657f068775801aeb706b7a07140a8ebbdef822b3bb…
- lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c4494…
- lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c4494…
- lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd4…
- lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd4…
- kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
- groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-r6j8-c6r2-37rr kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass | Medium | Also affects k8s.io/kubernetes |
| GHSA-4x4m-3c2p-qppc Kubernetes Nodes can delete themselves by adding an OwnerReference | Medium | Also affects k8s.io/kubernetes |
| GHSA-hj2p-8wj8-pfq4 kubernetes allows nodes to bypass dynamic resource allocation authorization checks | Low | Also affects k8s.io/kubernetes |
| GO-2025-3547 Kubernetes kube-apiserver Vulnerable to Race Condition | Low | Also affects k8s.io/kubernetes |
| GHSA-3wgm-2gw2-vh5m Kubernetes GitRepo Volume Inadvertent Local Repository Access | Medium | Also affects k8s.io/kubernetes |
| GHSA-vv39-3w5q-974q Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API | Medium | Also affects k8s.io/kubernetes |
| GHSA-jgfp-53c3-624w Node Denial of Service via kubelet Checkpoint API | Medium | Also affects k8s.io/kubernetes |
| GHSA-27wf-5967-98gx Kubernetes kubelet arbitrary command execution | High | Also affects k8s.io/kubernetes |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor