CVE-2020-8558

mediumpriority · attend · 46EPSS 0.034 · 89 %ileexploit · PoCEUFRUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

2 exploits · PoC

Likely / severe?

3.42% (89th) EPSS

CVSS 5.8 · medium

Is it mine?

32 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · osv · nvd

EPSS · scored 2026-10-27

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

Fixedopenshift4/ose-hyperkube@sha256:992b2cdf17c868f6a668d899ac06a60b696535ee70ec0e31efd17fe63a9130dd_ppc64le as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2926
Fixedopenshift4/ose-hyperkube@sha256:d36003d5b5831484297c42496d40345e453a1a5c04af665480fdc52bb5273ffa_s390x as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2926
Fixedopenshift4/ose-hyperkube@sha256:d8bf95b1f24d108406cd1c464b9fcd1319048e78d41d1d15dc4140be0b94d04f_amd64 as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2926
Fixedopenshift-0:4.4.0-202007090832.p0.git.0.bc32fb1.el7.src as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2927
Fixedopenshift-0:4.4.0-202007090832.p0.git.0.bc32fb1.el8.src as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2927
Fixedopenshift-hyperkube-0:4.4.0-202007090832.p0.git.0.bc32fb1.el7.ppc64le as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2927
Fixedopenshift-hyperkube-0:4.4.0-202007090832.p0.git.0.bc32fb1.el7.s390x as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2927
Fixedopenshift-hyperkube-0:4.4.0-202007090832.p0.git.0.bc32fb1.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2927
Fixedopenshift-hyperkube-0:4.4.0-202007090832.p0.git.0.bc32fb1.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.4redhat_csaf
For OpenShift Container Platform 4.4 see the following documentation, which will be updated shortly for release 4.4.13, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.4/release_notes/ocp-4-4-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.4/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:2927
Fixedopenshift-0:4.3.31-202007280738.p0.git.0.9884401.el7.src as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3183
Fixedopenshift-0:4.3.31-202007280738.p0.git.0.9884401.el8.src as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3183
Fixedopenshift-hyperkube-0:4.3.31-202007280738.p0.git.0.9884401.el7.ppc64le as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3183
Fixedopenshift-hyperkube-0:4.3.31-202007280738.p0.git.0.9884401.el7.s390x as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3183
Fixedopenshift-hyperkube-0:4.3.31-202007280738.p0.git.0.9884401.el7.x86_64 as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3183
Fixedopenshift-hyperkube-0:4.3.31-202007280738.p0.git.0.9884401.el8.ppc64le as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3183
Fixedopenshift-hyperkube-0:4.3.31-202007280738.p0.git.0.9884401.el8.s390x as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3183
Fixedopenshift-hyperkube-0:4.3.31-202007280738.p0.git.0.9884401.el8.x86_64 as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3183
Fixedopenshift4/ose-hyperkube@sha256:96af3c6ba7ed5a52350cfeb1ebecce7bf39743eeeca872c4de3c962b23fbf81a_ppc64le as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3184
Fixedopenshift4/ose-hyperkube@sha256:e5446b29f5856c8547c4217c8a0aacbc0a9a6760ff39acb4ac70c19f4501bc90_amd64 as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3184
Fixedopenshift4/ose-hyperkube@sha256:f9bdfc3dab76dbe7b39892f97997a94e444acf37801a8a53592b55a05cef331a_s390x as a component of Red Hat OpenShift Container Platform 4.3redhat_csaf
For OpenShift Container Platform 4.3 see the following documentation, which will be updated shortly for release 4.3.32, for important instructions on how to upgrade your cluster and fully apply this asynchronous errata update: https://docs.openshift.com/container-platform/4.3/release_notes/ocp-4-3-release-notes.html Details on how to access this content are available at https://docs.openshift.com/container-platform/4.3/updating/updating-cluster-cli.html.
https://access.redhat.com/errata/RHSA-2020:3184

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5.4–8.8

v2.05.8mediumAV:A/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USexploitability 6.5 · impact 6.4

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USexploitability 2.8 · impact 5.9

v3.15.4mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · ENISA EU

v3.15.4mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · jordan@liggitt.netexploitability 2.8 · impact 2.5

v3.18.8highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.18.3highCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.15.4mediumCVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:Nsecondary · Red Hat Product Security US

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-300USCWE-420USCWE-420US

exploits (2)

Public proof-of-concept and weaponised exploit code.

rhysemmas/martian-packetsCrafting raw TCP/IP packets to send to poorly configured Kubernetes servers - CVE-2020-8558 PoCPoC · poc_in_github
tabbysable/POC-2020-8558Information about Kubernetes CVE-2020-8558, including proof of concept exploit.PoC · poc_in_github

affected products (32)

Products and version ranges known to be affected.

Kubernetes Kubernetes≤ 1.12enisa_euvdEU
Kubernetes Kubernetes≤ prior to 1.18.4enisa_euvdEU
Kubernetes Kubernetes≤ 1.14enisa_euvdEU
Kubernetes Kubernetes≤ 1.7enisa_euvdEU
Kubernetes Kubernetes≤ 1.1enisa_euvdEU
Kubernetes Kubernetes≤ 1.15enisa_euvdEU
Kubernetes Kubernetes≤ 1.2enisa_euvdEU
Kubernetes Kubernetes≤ 1.10enisa_euvdEU
Kubernetes Kubernetes≤ 1.3enisa_euvdEU
Kubernetes Kubernetes≤ 1.9enisa_euvdEU
Kubernetes Kubernetes≤ 1.5enisa_euvdEU
Kubernetes Kubernetes≤ 1.8enisa_euvdEU
Kubernetes Kubernetes≤ 1.4enisa_euvdEU
Kubernetes Kubernetes≤ 1.13enisa_euvdEU
Kubernetes Kubernetes≤ 1.11enisa_euvdEU
Kubernetes Kubernetes≤ prior to 1.16.11enisa_euvdEU
Kubernetes Kubernetes≤ 1.6enisa_euvdEU
Kubernetes Kubernetes≤ prior to 1.17.7enisa_euvdEU
kubernetes kubernetes1.1.0 → 1.16.10nvdUScpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
kubernetes kubernetes1.17.0 → 1.17.6nvdUScpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*

showing 20 of 32

advisories (7)

Vendor and ecosystem advisories describing this.

RHSA-2020:2926Red Hat Security Advisory: OpenShift Container Platform 4.4.13 openshift-enterprise-hyperkube-container security update2020-07-21csaf · redhat_csafUS
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:2927Red Hat Security Advisory: OpenShift Container Platform 4.4.13 machine-config-daemon and openshift security update2020-07-21csaf · redhat_csafUS
An update for machine-config-daemon and openshift is now available for Red Hat OpenShift Container Platform 4.4. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:3183Red Hat Security Advisory: OpenShift Container Platform 4.3.31 openshift security update2020-08-05csaf · redhat_csafUS
An update for openshift is now available for Red Hat OpenShift Container Platform 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
RHSA-2020:3184Red Hat Security Advisory: OpenShift Container Platform 4.3.31 openshift-enterprise-hyperkube-container security update2020-08-05csaf · redhat_csafUS
An update for openshift-enterprise-hyperkube-container is now available for Red Hat OpenShift Container Platform 4.3. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
GHSA-wqv3-8cm6-h6wgImproper Authentication in Kubernetes2022-02-15ghsa · osvUS
A security issue was discovered in the Kubelet and kube-proxy components of Kubernetes which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. For example, if a cluster administrator runs a TCP service on a node that listens on 127.0.0.1:1234, because of this bug, that service would be potentially reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service. If the example service on port 1234 required no additional authentication (because it assumed that only other localhost processes could reach it), then it could be vulnerable to attacks that make use of this bug.
CERTFR-2026-AVI-1385Multiples vulnérabilités dans les produits VMwareFrançais2026-10-26vendor · certfrFR
GO-2022-0885Improper Authentication in Kubernetes in k8s.io/kubernetes2024-08-21vendor · osvUS
Improper Authentication in Kubernetes in k8s.io/kubernetes

also known as (5)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd osv nvd redhat_csaf certfr NVD CVE.org MITRE

published 2020-07-27modified 2026-06-17

references (24)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan