CVE-2020-8555

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

• CWE-918
• CWE-918

• http://www.openwall.com/lists/oss-security/2020/06/01/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/04/8Mailing List, Third Party Advisory
• https://github.com/kubernetes/kubernetes/issues/91542Third Party Advisory
• https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussionMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
• https://security.netapp.com/advisory/ntap-20200724-0005/Third Party Advisory
• http://www.openwall.com/lists/oss-security/2020/06/01/4Mailing List, Third Party Advisory
• http://www.openwall.com/lists/oss-security/2021/05/04/8Mailing List, Third Party Advisory
• https://github.com/kubernetes/kubernetes/issues/91542Third Party Advisory
• https://groups.google.com/d/topic/kubernetes-security-announce/kEK27tqqs30/discussionMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/3SOCLOPTSYABTE4CLTSPDIFE6ZZZR4LX/
• https://security.netapp.com/advisory/ntap-20200724-0005/Third Party Advisory

Published

Jun 5, 2020

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-8548massCode 1.0.0-alpha.6 allows XSS via crafted Markdown text,…6.1
• CVE-2020-8549Stored XSS in the Strong Testimonials plugin before 2.40.1 f…6.1
• CVE-2020-8551The Kubelet component in versions 1.15.0-1.15.9, 1.16.0-1.16…6.5
• CVE-2020-8552The Kubernetes API server component in versions prior to 1.1…4.3
• CVE-2020-8553The Kubernetes ingress-nginx component prior to version 0.28…5.9
• CVE-2020-8554Kubernetes API server in all versions allow an attacker who …5
• CVE-2020-8557The Kubernetes kubelet component in versions 1.1-1.16.12, 1.…5.5
• CVE-2020-8558The Kubelet and kube-proxy components in versions 1.1.0-1.16…8.8
• CVE-2020-8559The Kubernetes kube-apiserver in versions v1.6-v1.15, and ve…6.8
• CVE-2020-8561A security issue was discovered in Kubernetes where actors t…4.1
• CVE-2020-8562As mitigations to a report from 2019 and CVE-2020-8555, Kube…3.1
• CVE-2020-8563In Kubernetes clusters using VSphere as a cloud provider, wi…5.5