Webhook redirect in kube-apiserver
Published Sep 20, 2021
4.1
MEDIUMCVSS 3.1
EPSS 2.10%
Description
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Affected products
-
- Version 0StatusaffectedConstraints<*
- Version
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| Kubernetes | Kubernetes | n/a |
|
- 1.20.11
- 1.21.5
- 1.22.2
No data.
Red Hat OpenShift Container Platform 3.11
atomic-openshift
Out of support scope
Red Hat OpenShift Container Platform 4
openshift
Not affected
| Product | Package | State | Advisory |
|---|---|---|---|
| Red Hat OpenShift Container Platform 3.11 | atomic-openshift | Out of support scope | n/a |
| Red Hat OpenShift Container Platform 4 | openshift | Not affected | n/a |
k8s.io/kubernetes
Go
Introduced 0 Fixed not fixed
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| Go | k8s.io/kubernetes | 0 | not fixed |
Remediation
Red Hat statement
OpenShift Container Platform 4 does not support logging levels higher than 8 in the kube-apiserver (via the 'TraceAll' option), thereby making it not affected by this vulnerability. https://docs.openshift.com/container-platform/4.8/rest_api/operator_apis/kubeapiserver-operator-openshift-io-v1.html https://github.com/openshift/api/blob/release-4.8/operator/v1/types.go#L103
References (10)
- https://access.redhat.com/security/cve/CVE-2020-8561 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=2000366 Issue Tracking
- https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2002 Advisory
- https://github.com/advisories/GHSA-74j8-88mm-7496 Advisory
- https://github.com/kubernetes/kubernetes/issues/104720 x_refsource_MISCMitigationThird Party Advisory
- https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY x_refsource_MISCMailing ListMitigation
- https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves x_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2020-8561
- https://security.netapp.com/advisory/ntap-20211014-0002 x_refsource_CONFIRMThird Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2020-8561
| Link | Providers | Tags |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2020-8561 | Vendor Advisory | |
| https://bugzilla.redhat.com/show_bug.cgi?id=2000366 | Issue Tracking | |
| https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-2002 | Advisory | |
| https://github.com/advisories/GHSA-74j8-88mm-7496 | Advisory | |
| https://github.com/kubernetes/kubernetes/issues/104720 | x_refsource_MISCMitigationThird Party Advisory | |
| https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY | x_refsource_MISCMailing ListMitigation | |
| https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves | x_refsource_MISC | |
| https://nvd.nist.gov/vuln/detail/CVE-2020-8561 | ||
| https://security.netapp.com/advisory/ntap-20211014-0002 | x_refsource_CONFIRMThird Party Advisory | |
| https://www.cve.org/CVERecord?id=CVE-2020-8561 |
Change history (0)
No recorded changes yet.