{"id":"CVE-2020-8559","aliases":["GHSA-33c5-9fx5-fvjm","GO-2024-2748"],"url":"https://o3.security/vulnerability/CVE-2020-8559","summary":"Privilege Escalation in Kubernetes","details":"The Kubernetes kube-apiserver in versions v1.6-v1.15, and versions prior to v1.16.13, v1.17.9 and v1.18.6 are vulnerable to an unvalidated redirect on proxied upgrade requests that could allow an attacker to escalate privileges from a node compromise to a full cluster compromise.","published":"2020-07-22T14:15:16.517Z","modified":"2026-08-07T15:14:49.640219Z","cvss":{"score":6.8,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:H/I:H/A:H"},"epss":null,"cisaKev":null,"exploitsKnown":6,"affectedPackages":[{"ecosystem":"Go","name":"k8s.io/apimachinery","fixedVersion":"0.16.13"},{"ecosystem":"Go","name":"k8s.io/apimachinery","fixedVersion":"0.17.9"},{"ecosystem":"Go","name":"k8s.io/apimachinery","fixedVersion":"0.18.7"},{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.16.13"},{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.17.9"},{"ecosystem":"Go","name":"k8s.io/kubernetes","fixedVersion":"1.18.7"}],"fix":null,"references":[{"type":"ADVISORY","url":"https://security.netapp.com/advisory/ntap-20200810-0004/"},{"type":"FIX","url":"https://github.com/kubernetes/kubernetes/issues/92914"},{"type":"EVIDENCE","url":"https://groups.google.com/d/msg/kubernetes-security-announce/JAIGG5yNROs/19nHQ5wkBwAJ"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-08-07T15:14:49.640219Z"}}