CVE-2020-8558 is a high-severity vulnerability affecting Kubernetes Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3. This flaw allows adjacent hosts to access TCP and UDP services bound to 127.0.0.1 on a node, which are typically intended for local access only. With a CVSS score of 8.8 (HIGH), the vulnerability has an adjacent network attack vector (AV:A) with low attack complexity (AC:L), posing a significant risk of high impact to confidentiality, integrity, and availability (C:H/I:H/A:H). While there are no known public exploits or Metasploit/Nuclei modules, it has garnered some community discussion and media coverage, indicating awareness within the cybersecurity community.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 1.1.0, <= 1.16.10CPE matchmatch criteria | cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | ||
>= 1.17.0, <= 1.17.6CPE matchmatch criteria | cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* | ||
>= 1.18.0, <= 1.18.3CPE matchmatch criteria | cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.2 GitHub mentions.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Improper Authentication in Kubernetes
Feb 15, 2022kubernetes: node localhost services reachable via martian packets
Jul 8, 2020Kubernetes Networking Vulnerability (Loopback Interface Traffic Interception)
Jan 1, 2020Kubernetes Networking Vulnerability (Loopback Interface Exposure)
Node setting allows for neighboring hosts to bypass localhost boundary
Node setting allows for neighboring hosts to bypass localhost boundary
Node setting allows for neighboring hosts to bypass localhost boundary
Node setting allows for neighboring hosts to bypass localhost boundary
A networking vulnerability, CVE-2020-8558, was recently discovered in Kubernetes. Services sometimes communicate with other applications running inside the same Pod using the local loopback interface (127.0.0.1).