Kubernetes v1.36: Deprecation and removal of Service ExternalIPs

{
  "id": "cfa9f1d32fe40d72727c587178c09ec42156b5886dbc3f91718b2099d50aa580",
  "url": "https://kubernetes.io/blog/2026/05/14/kubernetes-v1-36-deprecation-and-removal-of-service-externalips/",
  "method": "llm",
  "payload": {
    "kind": "advisory",
    "title": "Kubernetes v1.36: Deprecation and removal of Service ExternalIPs",
    "summary": "Kubernetes 1.36 formally deprecates the Service .spec.externalIPs field because it can enable security exploits in clusters where users are not fully trusted. Users are advised to disable the field; removal is planned for future releases.",
    "evidence": "As a result, the .spec.externalIPs field for Service is now formally deprecated in Kubernetes 1.36.",
    "products": [
      {
        "name": {
          "value": "Kubernetes",
          "evidence": "the .spec.externalIPs field for Service is now formally deprecated in Kubernetes 1.36"
        },
        "prerequisites": [],
        "fixed_versions": [],
        "affected_versions": [
          {
            "value": "Kubernetes 1.36",
            "evidence": "the .spec.externalIPs field for Service is now formally deprecated in Kubernetes 1.36"
          }
        ]
      }
    ],
    "severity": "unknown",
    "fixed_cves": [],
    "related_cves": [
      {
        "value": "CVE-2020-8554",
        "evidence": "it enables various security exploits, as described in CVE-2020-8554"
      }
    ],
    "security_relevant": true,
    "severity_evidence": null
  },
  "source_id": "official-kubernetes-blog",
  "document_id": 24061,
  "published_at": "2026-05-14T18:35:00+00:00"
}