CVE-2020-8555

Kubernetes kube-controller-manager SSRF

MEDIUM

6.3

CVSS Score

Published: June 4, 2020 at 09:50 PM UTC

Updated: June 17, 2026 at 03:26 AM UTC

2 products affected across 2 vendorsFedoraKubernetes

Using Kubernetes by Kubernetes?

Get instant alerts when new vulnerabilities affect Kubernetes - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

MEDIUM6.3

Exploit prediction

EPSS 4%

Description

The Kubernetes kube-controller-manager in versions v1.0-1.14, versions prior to v1.15.12, v1.16.9, v1.17.5, and version v1.18.0 are vulnerable to a Server Side Request Forgery (SSRF) that allows certain authorized users to leak up to 500 bytes of arbitrary information from unprotected endpoints within the master's host network (such as link-local or loopback services).

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Fedora · Fedora Projectrpm

95%

Kubernetes · Kubernetes

95%

v < 1.15.111.15 ≤ v < 1.15.121.16 ≤ v < 1.16.91.16.0 ≤ v < 1.16.91.17 ≤ v < 1.17.51.17.0 ≤ v < 1.17.51.1 1.10 1.11 1.12 1.13 1.14 1.15 1.16 1.17 1.18.0 1.2 1.3 1.4 1.5 1.6 1.7 1.8 1.9

Affected range stops below 1.15.11, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.15.12, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.16.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 1.17.5, so it looks safe — our inference, not a vendor statement