CVE-2020-8561 MEDIUM

CVE-2020-8561: Webhook redirect in kube-apiserver

Vendor Kubernetes

Product Kubernetes

Weakness CWE-441

Published September 20, 2021

Last update June 1, 2026

View on NVD All CVEs

CVSS base score

4.1/10

Attack vector Network

Attack complexity Low

Privileges required High

User interaction None

Confidentiality Low

Integrity None

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N

What the vulnerability does

01Description

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

Key dates

02Disclosure timeline

September 20, 2021 CVE published

June 1, 2026 Record updated

External resources

03References

NVD — National Vulnerability Database https://nvd.nist.gov/vuln/detail/CVE-2020-8561 CWE — Common Weakness Enumeration https://cwe.mitre.org/data/definitions/441.html

Related vulnerabilities

04Related CVE

CVE-2026-39906 Unisys WebPerfect Image Suite 3.0 NTLMv2 Hash Leakage via .NET Remoting CVE-2025-47269 code-server session cookie can be extracted by having user visit specially crafted proxy URL CVE-2026-45003 OpenClaw < 2026.4.22 - Connector Endpoint Host Override via Workspace dotenv Files CVE-2026-3160 Unintended Proxy or Intermediary ('Confused Deputy') in GitLab CVE-2026-24471 Improper Validation in Conduit-derived homeservers resulting in Unintended Proxy or Intermediary ('Confused Deputy')