MEDIUM4.1
GHSA-74j8-88mm-7496
Confused Deputy in Kubernetes
Details
A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.
Are you affected?
Enter the version of the package you're using.
Affected packages
Go/k8s.io/kubernetes
Introduced in:
0No fixed version published yet for k8s.io/kubernetes (go modules). Pin to a known-safe version or switch to an alternative.
References
- https://nvd.nist.gov/vuln/detail/CVE-2020-8561[ADVISORY]
- https://github.com/kubernetes/kubernetes/issues/104720[WEB]
- https://github.com/kubernetes/kubernetes[PACKAGE]
- https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY[WEB]
- https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves[WEB]
- https://security.netapp.com/advisory/ntap-20211014-0002[WEB]