CVE-2020-8554
1 minute read
Vulnerability details Upstream issue
CVE-2020-8554 describes a traffic interception risk in Kubernetes service handling. An actor with permissions to create or update Service resources can abuse spec.externalIPs or status.loadBalancer.ingress.ip to redirect traffic.
Scope
Clusters that allow untrusted tenants to create or update Service objects are affected.
Prevention
- Restrict who can create or update
Serviceresources. - Restrict or deny untrusted
ExternalIPsusage through admission policy. - Audit and monitor changes to
Servicestatus updates, especiallyLoadBalanceringress IP updates.
Fixed by KLTS
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.
Last modified
April 15, 2026
: docs: add CVE-2020-8554 patch pages (70e8f5ca)