CVE-2020-8565

20

FAUCET Score

CVE-2020-8565 describes a vulnerability in Kubernetes where setting the logging level to 9 or higher causes authorization and bearer tokens to be written to log files, impacting API server logs and kubectl output. This medium-severity vulnerability (CVSS 5.5) has a local attack vector with low complexity, allowing an authenticated attacker to gain high confidentiality impact by accessing sensitive tokens. There is no evidence of active exploitation, public exploit code, or significant community discussion for this CVE.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 1.17.0, <= 1.17.13CPE matchmatch criteria	cpe:2.3:a:kubernetes:kubernetes::::::::
		>= 1.18.0, <= 1.18.10CPE matchmatch criteria	cpe:2.3:a:kubernetes:kubernetes::::::::
		>= 1.19.0, <= 1.19.3CPE matchmatch criteria	cpe:2.3:a:kubernetes:kubernetes::::::::

CVSS Data

CVSS version used by this source: 3.1

5.5MEDIUM

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

Exploitability Score

1.8

Impact Score

3.6

CvssVersion

3.1

Exploit Intelligence

EPSS Score

0.51%

Probability of exploitation in next 30 days

EPSS Percentile

40.6%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0051 is in the 93rd percentile among its peer group of 15,940 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (44)

check_pointpatch availablevia llm_extracted

chromepatch availablevia llm_extracted

gopatch availablevia ghsa

Product: k8s.io/client-goFixed in: 0.18.14

gopatch availablevia ghsa

Product: k8s.io/kubernetesFixed in: 1.20.0-alpha.2

gopatch availablevia ghsa

Product: k8s.io/client-goFixed in: 0.19.6

gopatch availablevia ghsa

Product: k8s.io/client-goFixed in: 0.20.0-alpha.2

gopatch availablevia ghsa

Product: k8s.io/client-goFixed in: 0.17.16

infiniflowpatch availablevia llm_extracted

microsoftpatch availablevia msrc

Product: 19143-17084Fixed in: 0.0.24-5

microsoftpatch availablevia msrc

Product: 19142-16820Fixed in: 1.17.13-5

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: mcg-0:5.9.0-28.61dcf87.5.9.el8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/cephcsi-rhel8:4.9-164.57484e3.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/ocs-must-gather-rhel8:4.9-257.4181add.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/ocs-operator-bundle:4.9.0-5

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/ocs-rhel8-operator:4.9-257.4181add.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/odf-console-rhel8:4.9-39.0f2fa23.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/odf-multicluster-operator-bundle:4.9.0-5

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/odf-multicluster-rhel8-operator:4.9-30.007b3d8.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/odf-operator-bundle:4.9.0-5

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/odf-rhel8-operator:4.9-59.c8bbc1f.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/odr-cluster-operator-bundle:4.9.0-5

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/odr-hub-operator-bundle:4.9.0-5

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/odr-rhel8-operator:4.9-27.3d037cc.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/rook-ceph-rhel8-operator:4.9-219.c3f67c6.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.7.0 on RHEL-8Fixed in: ocs4/rook-ceph-rhel8-operator:4.7-140.49a6fcf.release_4.7

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.8.0 on RHEL-8Fixed in: ocs4/cephcsi-rhel8:4.8-125.01872cc.release_4.8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.8.0 on RHEL-8Fixed in: ocs4/mcg-core-rhel8:5.8.0-38.e060925.5.8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.8.0 on RHEL-8Fixed in: ocs4/mcg-rhel8-operator:5.8.0-27.4a6ca5f.5.8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.8.0 on RHEL-8Fixed in: ocs4/ocs-must-gather-rhel8:4.8-196.a35d7d7.release_4.8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.8.0 on RHEL-8Fixed in: ocs4/ocs-operator-bundle:4.8.0-5

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.8.0 on RHEL-8Fixed in: ocs4/ocs-rhel8-operator:4.8-196.a35d7d7.release_4.8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.8.0 on RHEL-8Fixed in: ocs4/rook-ceph-rhel8-operator:4.8-167.9a9db5f.release_4.8

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Container Storage 4.8.0 on RHEL-8Fixed in: ocs4/volume-replication-rhel8-operator:4.8-20.ab575a2.release_v0.1

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf4/volume-replication-rhel8-operator:4.9-28.82f68db.release_4.9

redhatpatch availablevia redhat_api

Product: Red Hat OpenShift Data Foundation 4.9.0 on RHEL-8Fixed in: odf/odf-multicluster-rhel8-operator:4.9-30.007b3d8.release_4.9

vuepatch availablevia llm_extracted

denovendor investigatingvia llm_extracted

invoiceplanevendor investigatingvia llm_extracted

pjsipvendor investigatingvia llm_extracted

redhatno patchvia redhat_api

Product: Red Hat Openshift Container Storage 4Fixed in: odf4/ocs-rhel9-operator

redhatno patchvia redhat_api

Product: Red Hat Openshift Container Storage 4Fixed in: mcg

redhatend of lifevia redhat_api

Product: Red Hat OpenShift Container Platform 3.11Fixed in: atomic-openshift

redhatend of lifevia redhat_api

Product: Red Hat Storage 3Fixed in: heketi

redhatend of lifevia redhat_api

Product: Red Hat Storage 3Fixed in: rhgs3/rhgs-gluster-block-prov-rhel7

Vendor Advisories (10)

goGHSA-8cfg-vx93-jvxwmedium

Kubernetes client-go vulnerable to Sensitive Information Leak via Log File

microsoft2020-Dec/CVE-2020-8565Moderate

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

redhatCVE-2020-8565Moderate

kubernetes: Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

pjsipllm-pjsip-e46c3193693fba02

Kubernetes Secret Leaks in Logs

chromellm-chrome-80e91ce1c9359c41

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

check_pointllm-check_point-78478164da3cb8ec

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

infiniflowllm-infiniflow-b444d23673057276

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

vuellm-vue-496ef6040ab85bd7

Incomplete fix for CVE-2019-11250 allows for token leak in logs when logLevel >= 9

invoiceplanellm-invoiceplane-3c5ff73033b981d7

The Kubernetes project recently discovered several issues that allow for the exposure of secret data when verbose logging options are enabled.

denollm-deno-becf568e3986408a

Kubernetes Secret Data Exposure in Logs

References

github.com / kubernetes/kubernetes/issues/95623

Third Party Advisory

groups.google.com / g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ

Mailing ListPatchThird Party Advisory