{"items":[{"id":"NVI-00018553","kind":"vulnerability","title":"Potential proxy IP restriction bypass in Kubernetes","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-qh36-44jv-c8xj","CVE-2020-8562"],"plain_summary":"GitHub lists this reviewed advisory for k8s.io/kubernetes, k8s.io/kubernetes, k8s.io/kubernetes, k8s.io/kubernetes. Published version ranges and source prerequisites are shown below; this is not an inspection of a visitor’s application.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-3b420b7c7d6b2250bbce745ee4a7ab28"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"CVSS","as_of":"2026-06-09T10:51:52.000Z","value":"3.1 low","meaning":"GitHub source severity; exploitability and local consequence require separate evidence.","source_id":"sr-3b420b7c7d6b2250bbce745ee4a7ab28"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-3b420b7c7d6b2250bbce745ee4a7ab28","url":"https://github.com/advisories/GHSA-qh36-44jv-c8xj","basis":"vendor_advisory","notes":"GitHub Advisory Database; CC-BY-4.0. Each advisory links its original attribution. Null normalizes fields.","title":"GHSA-qh36-44jv-c8xj","publisher":"GitHub Advisory Database","observed_at":"2026-11-06T20:56:39.448Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-3b420b7c7d6b2250bbce745ee4a7ab28"],"technology":"k8s.io/kubernetes","known_exclusions":[],"conditions_summary":"As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.","public_affected_ranges":[">= 1.21.0, <= 1.21.1"]},{"certainty":"source_listed","source_ids":["sr-3b420b7c7d6b2250bbce745ee4a7ab28"],"technology":"k8s.io/kubernetes","known_exclusions":[],"conditions_summary":"As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.","public_affected_ranges":[">= 1.20.0, <= 1.20.7"]},{"certainty":"source_listed","source_ids":["sr-3b420b7c7d6b2250bbce745ee4a7ab28"],"technology":"k8s.io/kubernetes","known_exclusions":[],"conditions_summary":"As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.","public_affected_ranges":[">= 1.19.0, <= 1.19.11"]},{"certainty":"source_listed","source_ids":["sr-3b420b7c7d6b2250bbce745ee4a7ab28"],"technology":"k8s.io/kubernetes","known_exclusions":[],"conditions_summary":"As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.","public_affected_ranges":["<= 1.18.19"]}],"null_published_at":"2026-11-07T07:07:39.853Z","source_updated_at":"2026-06-09T10:51:52.000Z","source_disclosed_at":"2022-02-02T00:01:58.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-11-06T20:56:39.448Z"}],"next_cursor":null,"snapshot_revision":"42594"}