CVE-2020-8554: kubernetes Unverified Ownership
Vulnerability summary
CVE-2020-8554 is a medium (CVSS 6.3) Unverified Ownership vulnerability in kubernetes. EPSS estimates a 9.27% chance of exploitation in the next 30 days, higher than 95.3% of scored vulnerabilities. 1 public exploit is recorded.
Advisory lineage
Upstream 0 · Downstream 1 · Related 17Timeline
- 21-01-2021PublishedVulnerability first disclosed.
- 01-06-2026Last modifiedVulnerability information updated.
Description
Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.
CVSS metrics
8 scores · 7 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · DebianEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · WolfiEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · GoEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- OSV · ChainguardEcosystem advisory · calculated5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
- NVDNIST5.0MediumCVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:LDiffers
EPSS trend
Probability
9.27%
Chance of exploitation in the next 30 days
Percentile
95%
Versus all other CVEs
30-day change
0.00 pp
From 9.27% on 20-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundKubernetes
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Chainguard11 products
- kubeflow-pipelinesAll versions (No fix recorded)
- kubernetes-1.30All versions (No fix recorded)
- kubernetes-1.31All versions (No fix recorded)
- kubernetes-1.32All versions (No fix recorded)
- kubernetes-1.33All versions (No fix recorded)
Wolfi7 products
- kubeflow-pipelinesAll versions (No fix recorded)
- kubernetes-1.34All versions (No fix recorded)
- kubernetes-1.35All versions (No fix recorded)
- kubernetes-1.36All versions (No fix recorded)
- kubernetes-1.37All versions (No fix recorded)
Oracle3 products
Debian1 product
- kubernetes< 1.31.4+ds-1
K8s.io1 product
- kubernetes≤ 1.22.0
Kubernetes1 product
- kubernetesAll versions (No fix recorded)
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
7 vendors · 25 products
References
22 links- groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8X Refsource MISCAdvisoryWEBMailing ListThird Party Advisory
- github.com/kubernetes/kubernetes/issues/97076X Refsource MISCREPORTEVIDENCEWEBExploitThird Party Advisory
