CVE-2020-8561: kubernetes Confused Deputy
CVSS: 4.1v3.1MediumModified
AliasesUBUNTU-CVE-2020-8561DEBIAN-CVE-2020-8561CGA-2377-6f74-7fjqCGA-gmp6-3pvq-m5f6CGA-gv26-gmw4-5v8vCGA-jwgx-qq7x-xq2mCGA-q66h-3rw6-79x4CGA-w599-hpqq-h6x4GHSA-74j8-88mm-7496openSUSE-SU-2026:11388-1openSUSE-SU-2026:11389-1openSUSE-SU-2026:11390-1openSUSE-SU-2026:11391-1
Published 20-09-2021Last modified 01-06-2026
Vulnerability summary
CVE-2020-8561 is a medium (CVSS 4.1) Confused Deputy vulnerability in kubernetes. EPSS estimates a 2.10% chance of exploitation in the next 30 days, higher than 81.4% of scored vulnerabilities.
CVSS score
4.1/10
010
Medium · v3.1 (CVE.org)EPSS score
2.10%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 0 · Related 5Timeline
- 20-09-2021PublishedVulnerability first disclosed.
- 01-06-2026Last modifiedVulnerability information updated.
Description
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
CVSS metrics
8 scores · 7 sources · 2 versionsMedium 4.1Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:NSourcesAll 7 agree
- OSV · UbuntuEcosystem advisory · calculated4.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- OSV · DebianEcosystem advisory · calculated4.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- OSV · WolfiEcosystem advisory · calculated4.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- OSV · GoEcosystem advisory · calculated4.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- OSV · ChainguardEcosystem advisory · calculated4.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
- NVDNIST4.1MediumCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Medium 4.0Preferred score · NVD (NIST)
AV:N/AC:L/Au:S/C:P/I:N/A:NSourcesSingle source
EPSS trend
Probability
2.10%
Chance of exploitation in the next 30 days
Percentile
81%
Versus all other CVEs
30-day change
0.00 pp
From 2.10% on 20-09-2026
20-09-202620-10-2026
EPSS score2.10%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-441Unintended Proxy or Intermediary ('Confused Deputy')The product receives a request, message, or directive from an upstream component, but the product does not sufficiently preserve the original source of the request before forwarding the request to an external actor that is outside of the product's control sphere. This causes the product to appear to be the source of the request, leading it to act as a proxy or other intermediary between the upstream component and the external actor.
- CWE-610Externally Controlled Reference to a Resource in Another SphereThe product uses an externally controlled name or reference that resolves to a resource that is outside of the intended control sphere.
Affected systems
Opensuse4 products
- kubernetes1.33&distro=openSUSE Tumbleweed< 1.33.13-2.1
- kubernetes1.34&distro=openSUSE Tumbleweed< 1.34.10-1.1
- kubernetes1.35&distro=openSUSE Tumbleweed< 1.35.7-1.1
- kubernetes1.36&distro=openSUSE Tumbleweed< 1.36.3-1.1
Chainguard3 products
- kubeflow-pipelinesAll versions (No fix recorded)
- nodetaintAll versions (No fix recorded)
- spark-operatorAll versions (No fix recorded)
Wolfi3 products
- kubeflow-pipelinesAll versions (No fix recorded)
- nodetaintAll versions (No fix recorded)
- spark-operatorAll versions (No fix recorded)
Debian1 product
- kubernetes< 1.20.5+really1.20.2-1
K8s.io1 product
- kubernetes≤ 1.22.2
Kubernetes1 product
- kubernetesEOLAll versions (No fix recorded) | 1.20.11 | 1.21.5 | 1.22.2
Ubuntu1 product
- kubernetesAll versions (No fix recorded)
7 vendors · 14 products
References
12 links- groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsYX Refsource MISCARTICLEWEBMailing ListMitigation
- github.com/kubernetes/kubernetes/issues/104720X Refsource MISCREPORTWEBMitigationThird Party Advisory
