CVE catalog

CVE-2020-8561

kubernetes affected and fixed versions

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

Severity: Medium · CVSS 4.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N
Published: Jan 1, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 2.10% · Oct 27, 2026

Projects and upstream resources

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie	kubernetes	`1.20.5+really1.20.2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-8561]
Debiantrixie	kubernetes	`1.32.3+ds-2`	Fixed	[CVE-2020-8561]
Debiansid	kubernetes	`1.20.5+really1.20.2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-8561]
Debiansid	kubernetes	`1.36.4+ds-1`	Fixed	[CVE-2020-8561]
Debianforky	kubernetes	`1.20.5+really1.20.2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-8561]
Debianforky	kubernetes	`1.36.4+ds-1`	Fixed	[CVE-2020-8561]
Debianbookworm	kubernetes	`1.20.5+really1.20.2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-8561]
Debianbookworm	kubernetes	`1.20.5+really1.20.2-1.1+deb12u1`	Fixed	[CVE-2020-8561]

Showing 8 fix observations. All 12 observations, including unknown and conflicting reports, are available below.

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	kubernetes	`1.20.5+really1.20.2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-8561]
Debianbookworm	kubernetes	`1.20.5+really1.20.2-1.1+deb12u1`	Fixed	[CVE-2020-8561]
Debianforky	kubernetes	`1.20.5+really1.20.2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-8561]
Debianforky	kubernetes	`1.36.4+ds-1`	Fixed	[CVE-2020-8561]
Debiansid	kubernetes	`1.20.5+really1.20.2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-8561]
Debiansid	kubernetes	`1.36.4+ds-1`	Fixed	[CVE-2020-8561]
Debiantrixie	kubernetes	`1.20.5+really1.20.2-1`	FixedDistribution-reported fixed boundary	[CVE-2020-8561]
Debiantrixie	kubernetes	`1.32.3+ds-2`	Fixed	[CVE-2020-8561]
Opensusetumbleweed	kubernetes1.33	`1.33.13-2.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:11388-1]Jul 29, 2026, 6:24:26 PM UTC
Opensusetumbleweed	kubernetes1.34	`1.34.10-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:11389-1]Jul 29, 2026, 6:24:26 PM UTC
Opensusetumbleweed	kubernetes1.35	`1.35.7-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:11390-1]Jul 29, 2026, 6:24:26 PM UTC
Opensusetumbleweed	kubernetes1.36	`1.36.3-1.1`	UnknownSource applicability is not established	[OPENSUSE-SU-2026:11391-1]Jul 29, 2026, 6:24:26 PM UTC

Original provider fields

{
  "package_releases": [
    {
      "name": "kubernetes",
      "status": "fixed",
      "release": "sid",
      "version": "1.36.4+ds-1"
    },
    {
      "name": "kubernetes",
      "status": "fixed",
      "release": "forky",
      "version": "1.36.4+ds-1"
    },
    {
      "name": "kubernetes",
      "status": "fixed",
      "release": "trixie",
      "version": "1.32.3+ds-2"
    },
    {
      "name": "kubernetes",
      "status": "fixed",
      "release": "bookworm",
      "version": "1.20.5+really1.20.2-1.1+deb12u1"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "kubernetes",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1.20.5+really1.20.2-1"
    },
    {
      "bug": null,
      "name": "kubernetes",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1.20.5+really1.20.2-1"
    },
    {
      "bug": null,
      "name": "kubernetes",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1.20.5+really1.20.2-1"
    },
    {
      "bug": null,
      "name": "kubernetes",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1.20.5+really1.20.2-1"
    }
  ],
  "distribution_packages": [
    {
      "name": "kubernetes1.35",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.35.7-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11390-1",
      "fixed_version": "1.35.7-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11390-1",
      "provider_updated_at": "2026-07-29T18:24:26.291086955Z",
      "applicability_unknown": true
    },
    {
      "name": "kubernetes1.33",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.33.13-2.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11388-1",
      "fixed_version": "1.33.13-2.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11388-1",
      "provider_updated_at": "2026-07-29T18:24:26.273462438Z",
      "applicability_unknown": true
    },
    {
      "name": "kubernetes1.34",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.34.10-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11389-1",
      "fixed_version": "1.34.10-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11389-1",
      "provider_updated_at": "2026-07-29T18:24:26.261400268Z",
      "applicability_unknown": true
    },
    {
      "name": "kubernetes1.36",
      "distro": "opensuse",
      "ranges": [
        {
          "type": "ECOSYSTEM",
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "1.36.3-1.1"
            }
          ]
        }
      ],
      "release": "tumbleweed",
      "versions": [],
      "ecosystem": "rpm",
      "provider_url": "https://osv.dev/vulnerability/openSUSE-SU-2026:11391-1",
      "fixed_version": "1.36.3-1.1",
      "provider_source": "pypi",
      "provider_record_id": "OPENSUSE-SU-2026:11391-1",
      "provider_updated_at": "2026-07-29T18:24:26.252789378Z",
      "applicability_unknown": true
    }
  ]
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[kubernetes-client]Unknown
Source package: [kubernetes]
Details (2)
- 1.20.5+really1.20.2-1.1+deb12u1 · amd64 · bookworm
  Fixed · Fixed: 1.20.5+really1.20.2-1
  dsa · kubernetes · debian · bookworm; dsa · kubernetes · debian · 12
- 1.20.5+really1.20.2-1.1+deb12u1 · arm64 · bookworm
  Fixed · Fixed: 1.20.5+really1.20.2-1
  dsa · kubernetes · debian · bookworm; dsa · kubernetes · debian · 12

[Debian 13 (Trixie)]

[golang-k8s-kubectl-dev]Unknown
Source package: [kubernetes]
Details (2)
- 1.32.3+ds-2 · all · trixie
  Fixed · Fixed: 1.20.5+really1.20.2-1
  dsa · kubernetes · debian · 13
- 1.32.3+ds-2 · all · trixie
  Fixed · Fixed: 1.20.5+really1.20.2-1
  dsa · kubernetes · debian · 13
[kubectl]Unknown
Source package: [kubernetes]
Details (2)
- 1.32.3+ds-2 · amd64 · trixie
  Fixed · Fixed: 1.20.5+really1.20.2-1
  dsa · kubernetes · debian · 13
- 1.32.3+ds-2 · arm64 · trixie
  Fixed · Fixed: 1.20.5+really1.20.2-1
  dsa · kubernetes · debian · 13
[kubernetes-client]Unknown
Source package: [kubernetes]
Details (2)
- 1.32.3+ds-2 · amd64 · trixie
  Fixed · Fixed: 1.20.5+really1.20.2-1
  dsa · kubernetes · debian · 13
- 1.32.3+ds-2 · arm64 · trixie
  Fixed · Fixed: 1.20.5+really1.20.2-1
  dsa · kubernetes · debian · 13

[openSUSE Tumbleweed]

[kubernetes1.34-apiserver]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-client]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-client-bash-completion]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-client-common]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-client-fish-completion]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-controller-manager]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-kubeadm]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-kubelet]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-kubelet-common]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-proxy]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.34-scheduler]Unknown
Source package: [kubernetes1.34]
Details (1)
- 1.34.11-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.34.10-1.1
  Version impact unknown
  dsa · kubernetes1.34 · opensuse · tumbleweed
[kubernetes1.35-apiserver]Unknown
Source package: [kubernetes1.35]
Details (1)
- 1.35.8-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.35.7-1.1
  Version impact unknown
  dsa · kubernetes1.35 · opensuse · tumbleweed
[kubernetes1.35-client]Unknown
Source package: [kubernetes1.35]
Details (1)
- 1.35.8-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.35.7-1.1
  Version impact unknown
  dsa · kubernetes1.35 · opensuse · tumbleweed
[kubernetes1.35-client-bash-completion]Unknown
Source package: [kubernetes1.35]
Details (1)
- 1.35.8-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.35.7-1.1
  Version impact unknown
  dsa · kubernetes1.35 · opensuse · tumbleweed
[kubernetes1.35-client-common]Unknown
Source package: [kubernetes1.35]
Details (1)
- 1.35.8-1.1 · x86_64 · tumbleweed
  Unknown · Fixed: 1.35.7-1.1
  Version impact unknown
  dsa · kubernetes1.35 · opensuse · tumbleweed
[kubernetes1.35-client-fish-completion]Unknown
Source package: [kubernetes1.35]
Details (1)
- 1.35.8-1.1 · noarch · tumbleweed
  Unknown · Fixed: 1.35.7-1.1
  Version impact unknown
  dsa · kubernetes1.35 · opensuse · tumbleweed

Next results

Observed: Oct 23, 2026, 5:53:32 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]