Homepage

CVE-2020-8554 The advisory has been revoked - it doesn't affect any version of package kubernetes-1.32  (opens in a new tab)

Threat Intelligence

EPSS
8.72% (96th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-CHAINGUARDLATEST-KUBERNETES132-12027667
  • published7 Jan 2026
  • disclosed21 Jan 2021
Report a new vulnerability Found a mistake?

Introduced: 21 Jan 2021

CVE-2020-8554  (opens in a new tab)

Amendment

The Chainguard security team deemed this advisory irrelevant for Chainguard:latest.

NVD Description

Note: Versions mentioned in the description apply only to the upstream kubernetes-1.32 package and not the kubernetes-1.32 package as distributed by Chainguard.

Kubernetes API server in all versions allow an attacker who is able to create a ClusterIP service and set the spec.externalIPs field, to intercept traffic to that IP address. Additionally, an attacker who is able to patch the status (which is considered a privileged operation and should not typically be granted to users) of a LoadBalancer service can set the status.loadBalancer.ingress.ip to similar effect.

References