GHSA-wqv3-8cm6-h6wg CVE-2020-8558 GO-2022-0885

Improper Authentication in Kubernetes

High Go

Severity: 8.8 / 10; High · CVSS 3.1
Exploit chance (EPSS): 3.42%; Chance of exploitation in the next 30 days. Higher than 88.90% of scored vulnerabilities.
Known exploited: No; Not in CISA's catalog
Weakness: CWE-420 Unprotected Alternate Channel
Fix: 1.18.4; Upgrade k8s.io/kubernetes to this version or later

Description

A security issue was discovered in the Kubelet and kube-proxy components of Kubernetes which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug.

Affected versions

Go

Package	Vulnerable	Fixed in
k8s.io/kubernetes	`>= 1.18.0, < 1.18.4`	`1.18.4`
k8s.io/kubernetes	`>= 1.17.0, < 1.17.7`	`1.17.7`
k8s.io/kubernetes	`< 1.16.11`	`1.16.11`
k8s.io/kubernetes	`< 1.16.11` `>= 1.17.0, < 1.17.7` `>= 1.18.0, < 1.18.4`	`1.16.11` `1.17.7` `1.18.4`

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

k8s.io/kubernetes Go → `1.18.4`

go

go get k8s.io/kubernetes@v1.18.4 && go mod tidy

Severity breakdown

CVSS 3.1 8.8

CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack vector: Adjacent
Attack complexity: Low
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

Weakness

CWE-420: Unprotected Alternate Channel

The product protects a primary channel, but it does not use the same level of protection for an alternate channel.

How to prevent it

Architecture and Design: Identify all alternate channels and use the same protection mechanisms that are used for the primary channels.

References

Advisories

nvd.nist.gov/vuln/detail/CVE-2020-8558

Packages

github.com/kubernetes/kubernetes

Timeline

Feb 15, 2022 Published
Sep 10, 2026 Last updated by the source
Oct 31, 2026 Latest EPSS score

Advisory	Severity	Why it's related
GHSA-r6j8-c6r2-37rr kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass	Medium	Also affects k8s.io/kubernetes
GHSA-4x4m-3c2p-qppc Kubernetes Nodes can delete themselves by adding an OwnerReference	Medium	Also affects k8s.io/kubernetes
GHSA-hj2p-8wj8-pfq4 kubernetes allows nodes to bypass dynamic resource allocation authorization checks	Low	Also affects k8s.io/kubernetes
GO-2025-3547 Kubernetes kube-apiserver Vulnerable to Race Condition	Low	Also affects k8s.io/kubernetes
GHSA-3wgm-2gw2-vh5m Kubernetes GitRepo Volume Inadvertent Local Repository Access	Medium	Also affects k8s.io/kubernetes
GHSA-vv39-3w5q-974q Kubernetes allows Command Injection affecting Windows nodes via nodes/*/logs/query API	Medium	Also affects k8s.io/kubernetes
GHSA-jgfp-53c3-624w Node Denial of Service via kubelet Checkpoint API	Medium	Also affects k8s.io/kubernetes
GHSA-27wf-5967-98gx Kubernetes kubelet arbitrary command execution	High	Also affects k8s.io/kubernetes

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor