Medium
Security advisory
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2020-8559
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:54 UTC · Revision 1
Source evidence
The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.
osv:CVE-2020-8559
Complete source record
{
"id": "fbd04caa9b6f83c083753b35a6074b13ef5397d7cc7d4f6175b835ecdf552b6f",
"url": "https://osv.dev/vulnerability/CVE-2020-8559",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2020-8559",
"summary": "The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.",
"evidence": "osv:CVE-2020-8559",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2020-8559",
"aliases": [
"CVE-2020-8559",
"GHSA-33c5-9fx5-fvjm",
"GO-2024-2748"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/kubernetes/kubelet",
"type": "GIT",
"events": [
{
"introduced": "0"
},
{
"last_affected": "f1cb295a73c9298232b9848aa1b4029e36fc91e5"
},
{
"introduced": "250a1838aa2c492c9096ff86558515b8639d7e87"
},
{
"fixed": "3c88459e7af1fdf57330d5fecc6b86463c7a9a6c"
},
{
"introduced": "f9974c2baa2d9ca25416d38e7ecfc7ff4d05d58e"
},
{
"fixed": "9f5e297ceb293eee23d4d86db30e97358b96f6d4"
},
{
"introduced": "f0d06ae44a2e7ef0c05aecb6e7773222947dd156"
},
{
"fixed": "4dc5f6e0726373dc6bdf4916cdf61ac382287ccb"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.6.0"
},
{
"last_affected": "1.15.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.16.0"
},
{
"fixed": "1.16.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.17.0"
},
{
"fixed": "1.17.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.18.0"
},
{
"fixed": "1.18.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"kubernetes-1.15.0",
"kubernetes-1.9.0-alpha.3",
"kubernetes-1.9.0-alpha.2",
"kubernetes-1.9.0-alpha.1",
"kubernetes-1.9.0-alpha.0",
"kubernetes-1.13.0-alpha.0",
"kubernetes-1.12.0-beta.0",
"kubernetes-1.12.0-alpha.1",
"kubernetes-1.12.0-alpha.0",
"kubernetes-1.11.0-alpha.2",
"kubernetes-1.11.0-alpha.1",
"kubernetes-1.11.0-alpha.0",
"kubernetes-1.10.0-alpha.3",
"kubernetes-1.10.0-alpha.2",
"kubernetes-1.10.0-alpha.1",
"kubernetes-1.10.0-alpha.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8559.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/kubernetes/kubernetes",
"type": "GIT",
"events": [
{
"introduced": "fff5156092b56e6bd60fff75aad4dc9de6b6ef37"
},
{
"last_affected": "e8462b5b5dc2584fdcd18e6bcfe9f1e4d970a529"
},
{
"introduced": "2bd9643cee5b3b3a5ecbd3af49d09018f0773c77"
},
{
"fixed": "39a145ca3413079bcb9c80846488786fed5fe1cb"
},
{
"introduced": "70132b0f130acc0bed193d9ba59dd186f0e634cf"
},
{
"fixed": "4fb7ed12476d57b8437ada90b4f93b17ffaeed99"
},
{
"introduced": "9e991415386e4cf155a24b1da15becaa390438d8"
},
{
"fixed": "dff82dc0de47299ab66c83c626e08b245ab19037"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.6.0"
},
{
"last_affected": "1.15.0"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.16.0"
},
{
"fixed": "1.16.13"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.17.0"
},
{
"fixed": "1.17.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*",
"range": [
{
"introduced": "1.18.0"
},
{
"fixed": "1.18.6"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"v1.16.13-rc.0",
"v1.18.6-rc.0",
"v1.17.9-rc.0",
"v1.18.5",
"v1.17.8",
"v1.16.12",
"v1.16.12-rc.1",
"v1.18.5-rc.1",
"v1.17.8-rc.1",
"v1.16.12-rc.0",
"v1.18.5-rc.0",
"v1.17.8-rc.0",
"v1.16.11",
"v1.18.4",
"v1.17.7",
"v1.16.11-rc.0",
"v1.17.7-rc.0",
"v1.16.10",
"v1.18.4-rc.0",
"v1.17.6",
"v1.18.3",
"v1.18.3-beta.0",
"v1.16.10-beta.0",
"v1.17.6-beta.0",
"v1.18.2",
"v1.16.9",
"v1.17.5",
"v1.18.2-beta.0",
"v1.18.1",
"v1.18.1-beta.0",
"v1.18.0",
"v1.16.9-beta.0",
"v1.17.5-beta.0",
"v1.17.4",
"v1.16.8",
"v1.16.8-beta.0",
"v1.16.7",
"v1.17.4-beta.0",
"v1.17.3",
"v1.16.7-beta.0",
"v1.17.3-beta.0",
"v1.16.6",
"v1.17.2",
"v1.17.2-beta.0",
"v1.16.6-beta.0",
"v1.16.5",
"v1.17.1",
"v1.16.5-beta.1",
"v1.16.5-beta.0",
"v1.16.4",
"v1.17.0",
"v1.17.1-beta.0",
"v1.16.4-beta.0",
"v1.16.3",
"v1.16.2",
"v1.16.3-beta.0",
"v1.16.2-beta.0",
"v1.16.1",
"v1.16.1-beta.0",
"v1.16.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-8559.json"
}
}
],
"modified": "2026-10-24T10:50:39.755201255Z",
"provider": "osv",
"references": [
"https://security.netapp.com/advisory/ntap-20200810-0004/",
"https://github.com/kubernetes/kubernetes/issues/92914",
"https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2020-8559",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 442427,
"published_at": "2020-07-22T14:15:16.517+00:00"
}