---
id: CVE-2020-8559
aliases:
  - GHSA-33c5-9fx5-fvjm
  - GO-2024-2748
title: Privilege Escalation in Kubernetes
summary: Privilege Escalation in Kubernetes
severity: medium
cvss: 6.8
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H'
vendor: apimachinery
product: k8s.io/apimachinery
ecosystem: go
affected:
  - k8s.io/apimachinery < 0.16.13
  - 'k8s.io/apimachinery >= 0.17.0, < 0.17.9'
  - 'k8s.io/apimachinery >= 0.18.0, < 0.18.7'
  - k8s.io/kubernetes < 1.16.13
  - 'k8s.io/kubernetes >= 1.17.0, < 1.17.9'
  - 'k8s.io/kubernetes >= 1.18.0, < 1.18.7'
patched:
  - k8s.io/apimachinery 0.16.13
  - k8s.io/apimachinery 0.17.9
  - k8s.io/apimachinery 0.18.7
  - k8s.io/kubernetes 1.16.13
  - k8s.io/kubernetes 1.17.9
  - k8s.io/kubernetes 1.18.7
published: '2024-04-24'
updated: '2026-09-10'
sourceUpdated: '2026-09-10T03:50:10.993460921Z'
source: OSV
sourceUrl: 'https://osv.dev/vulnerability/GHSA-33c5-9fx5-fvjm'
references:
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2020-8559'
  - url: 'https://github.com/kubernetes/kubernetes/issues/92914'
  - url: 'https://github.com/kubernetes/kubernetes/pull/92941'
  - url: 'https://bugzilla.redhat.com/show_bug.cgi?id=1851422'
  - url: 'https://github.com/kubernetes/kubernetes'
  - url: 'https://github.com/tdwyer/CVE-2020-8559'
  - url: >-
      https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ
  - url: 'https://groups.google.com/g/kubernetes-security-announce/c/JAIGG5yNROs'
  - url: 'https://security.netapp.com/advisory/ntap-20200810-0004'
tags:
  - osv
  - go
  - exploit-available
epss: 0.061
epssPercentile: 0.93112
exploits:
  github: 2
  githubRepos:
    - 'https://github.com/tabbysable/POC-2020-8559'
    - 'https://github.com/tdwyer/CVE-2020-8559'
  checkedAt: '2026-09-24T07:52:50.569Z'
exploitAvailable: true
ingestedAt: '2026-09-12T03:13:01.747Z'
---

## Overview

The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.7 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.

## Affected packages

- `k8s.io/apimachinery < 0.16.13`
- `k8s.io/apimachinery >= 0.17.0, < 0.17.9`
- `k8s.io/apimachinery >= 0.18.0, < 0.18.7`
- `k8s.io/kubernetes < 1.16.13`
- `k8s.io/kubernetes >= 1.17.0, < 1.17.9`
- `k8s.io/kubernetes >= 1.18.0, < 1.18.7`

## Remediation

Upgrade to a patched release:

- `k8s.io/apimachinery 0.16.13`
- `k8s.io/apimachinery 0.17.9`
- `k8s.io/apimachinery 0.18.7`
- `k8s.io/kubernetes 1.16.13`
- `k8s.io/kubernetes 1.17.9`
- `k8s.io/kubernetes 1.18.7`