CoreCVE
Back

HIGH

Kubernetes node setting allows for neighboring hosts to bypass localhost boundary

Published Jul 27, 2020

Description

The Kubelet and kube-proxy components in versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3 were found to contain a security issue which allows adjacent hosts to reach TCP and UDP services bound to 127.0.0.1 running on the node or in the node's network namespace. Such a service is generally thought to be reachable only by other processes on the same host, but due to this defeect, could be reachable by other hosts on the same LAN as the node, or by containers running on the same node as the service.

Affected products

Remediation

Red Hat statement

OpenShift Container Platform does not expose the API server on a localhost port without authentication. The only service exposed on a localhost port not protected by authentication is Metrics, which exposes some cluster metadata.

Metrics

Weaknesses (2)

CWE-300

CWE-420

References (14)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner kubernetes
Published Jul 27, 2020
Updated Sep 16, 2024
Reserved Feb 3, 2020
Link CVE-2020-8558
CISA Vulnrichment
Updated n/a
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2020-8558
Red Hat
Severity Moderate
Public date Jul 8, 2020
Links CVE-2020-8558 - Bugzilla
GHSA-WQV3-8CM6-H6WG