CVE-2020-8561: Confused Deputy in Kubernetes

September 21, 2021 (updated June 9, 2026)

A security issue was discovered in Kubernetes where actors that control the responses of MutatingWebhookConfiguration or ValidatingWebhookConfiguration requests are able to redirect kube-apiserver requests to private networks of the apiserver. If that user can view kube-apiserver logs when the log level is set to 10, they can view the redirected responses and headers in the logs.

References

github.com/advisories/GHSA-74j8-88mm-7496
github.com/kubernetes/kubernetes/issues/104720
groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY
kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
nvd.nist.gov/vuln/detail/CVE-2020-8561
security.netapp.com/advisory/ntap-20211014-0002

Code Behaviors & Features

Detect and mitigate CVE-2020-8561 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →