VDB

CVE-2020-8554

CVE-2020-8554 REJECTED

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

EPSS 25.26% · 96.3th percentile

Risk Scores

EPSS Score
25.26%
96.3th percentile

Affected Products

VendorProductVersions
Ubuntu:Pro:20.04:LTSkubernetes0, 1.0
Ubuntu:22.04:LTSkubernetes0, 1.0
Ubuntu:24.04:LTSkubernetes0, 1.0

Exploit Intelligence

…and 93 more exploits

Timeline

  • CVE Published
  • Apr 14, 2021 EPSS Score
  • Jul 21, 2021 EPSS Score
  • Nov 4, 2021 PoC Published
  • Feb 8, 2022 EPSS Score
  • Apr 20, 2022 EPSS Score
  • Mar 17, 2025 EPSS Score
  • Mar 19, 2025 EPSS Score
  • Mar 20, 2025 EPSS Score
  • Mar 22, 2025 EPSS Score
  • Mar 27, 2025 EPSS Score
  • Mar 28, 2025 EPSS Score
Open in Interactive Console →
$ Console Community · 100/wk Open console ›