{"id":"CVE-2020-8561","aliases":["GHSA-74j8-88mm-7496"],"title":"Confused Deputy in Kubernetes","summary":"Confused Deputy in Kubernetes","severity":"medium","cvss":4.1,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:N/A:N","vendor":"kubernetes","product":"k8s.io/kubernetes","ecosystem":"go","affected":["k8s.io/kubernetes <= 1.22.2"],"published":"2021-09-21","updated":"2026-09-10","sourceUpdated":"2026-09-10T03:49:08.708639983Z","source":"OSV","sourceUrl":"https://osv.dev/vulnerability/GHSA-74j8-88mm-7496","references":[{"url":"https://nvd.nist.gov/vuln/detail/CVE-2020-8561"},{"url":"https://github.com/kubernetes/kubernetes/issues/104720"},{"url":"https://github.com/kubernetes/kubernetes"},{"url":"https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY"},{"url":"https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves"},{"url":"https://security.netapp.com/advisory/ntap-20211014-0002"}],"tags":["osv","go"],"epss":0.021,"epssPercentile":0.80625,"ingestedAt":"2026-09-12T03:13:01.762Z","slug":"CVE-2020-8561","body":"## Overview\n\nA security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.\n\n## Affected packages\n\n- `k8s.io/kubernetes <= 1.22.2`\n\n## Remediation\n\nRefer to the advisory for the patched release.","depth":"sunlit","depthScore":23,"depthScoreParts":{"impact":22.5,"likelihood":0.4,"exploitation":0,"ransomware":0},"changes":[]}