CVE-2020-8554: Kubernetes

Medium severity, CVSS 5.0. EPSS: 9.3% chance of exploitation in the next 30 days.

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

Affected products

• Kubernetes Kubernetes: any version
• Oracle Communications Cloud Native Core Network Slice Selection Function: version 1.2.1 only
• Oracle Communications Cloud Native Core Policy: version 1.15.0 only
• Oracle Communications Cloud Native Core Service Communication Proxy: version 1.14.0 only

Published 2021-01-21. Last modified 2026-06-17.