GitHub Advisoryadvisory · Go

GHSA-74j8-88mm-7496 Confused Deputy in Kubernetes

MEDIUM Published 2021-09-21 Modified 2026-06-09 Official page ↗
Aliases
CVE-2020-8561
Ecosystem
Go
Packages
k8s.io/kubernetes
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Weaknesses
CWE-441, CWE-610
Reviewed
2021-09-21

Affected packages

• Go k8s.io/kubernetes: <= 1.22.2 (no fix yet)

Description

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

Related

Alias · CVE (1)

  • CVE-2020-8561 A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or… vulnerability

Weakness · CWE (2)

  • CWE-441 Unintended Proxy or Intermediary weakness
  • CWE-610 Externally Controlled Reference to a Resource in Another Sphere weakness

References