# CVE-2020-8554: Kubernetes traffic interception via unverified ExternalIPs ownership

Source: https://junglewise.ai/threats/cve-2020-8554-kubernetes-traffic-interception-via-unverified-externalips  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2022-02-08. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2020-8554 · Severity: medium · CVSS 5 · Published 2022-02-08

Kubernetes, the industry-standard platform for managing containerized applications, contains a design flaw that allows users with basic permissions to intercept network traffic. By creating a specific type of network service, an attacker can redirect traffic intended for external IP addresses to their own malicious containers. This could lead to the theft of sensitive data or the disruption of communications between different parts of a corporate network.

Technologies: [k8s.io/kubernetes (Go)](https://junglewise.ai/threats/technologies/k8s-io-kubernetes), [Kubernetes](https://junglewise.ai/threats/technologies/kubernetes). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Kubernetes](https://junglewise.ai/threats/vendors/kubernetes).

## Quick answers

**Is CVE-2020-8554 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-8554 being exploited in the wild.

**How severe is CVE-2020-8554?** Medium severity, with a CVSS score of 5, published 8 February 2022.

**Which products and versions are affected?** k8s.io/kubernetes (Go) <= 1.22.0, SEMVER:introduced=0,last_affected=1.22.0; Kubernetes <= 1.22.0.

**Is there a fix for CVE-2020-8554?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-8554 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2020-8554?** Check whether you run k8s.io/kubernetes (Go) or Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A design flaw in the Kubernetes API server allows for man-in-the-middle (MitM) attacks via unverified ownership of IP addresses. An attacker with permissions to create or edit Services and Pods can set the 'spec.externalIPs' field in a ClusterIP service to a target IP, causing the cluster to route traffic for that IP to the attacker's service. Additionally, if an attacker has the highly privileged permission to patch the 'status' of a LoadBalancer service, they can achieve a similar effect by modifying 'status.loadBalancer.ingress.ip'. This is a fundamental architectural issue with no direct code patch; mitigation requires using admission controllers (like the externalip-webhook) to restrict or allowlist the use of ExternalIPs.

## Affected products

- Kubernetes Kubernetes <= 1.22.0

## Identifiers

- CVE-2020-8554
- GHSA-j9wf-vvm6-4r9w

## Timeline

- 2020-12-04: disclosed: Issue first opened on GitHub
- 2021-01-21: advisory: NVD publication date
- 2022-02-08: advisory: GitHub Advisory published

## References

- [https://github.com/kubernetes/kubernetes/issues/97076](https://github.com/kubernetes/kubernetes/issues/97076)
- [https://github.com/kubernetes/kubernetes/issues/97110](https://github.com/kubernetes/kubernetes/issues/97110)
- [https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8](https://groups.google.com/g/kubernetes-security-announce/c/iZWsF9nbKE8)
- [https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@%3Ccommits.druid.apache.org%3E](https://lists.apache.org/thread.html/r0c76b3d0be348f788cd947054141de0229af00c540564711e828fd40@%3Ccommits.druid.apache.org%3E)
- [https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@%3Ccommits.druid.apache.org%3E](https://lists.apache.org/thread.html/r1975078e44d96f2a199aa90aa874b57a202eaf7f25f2fde6d1c44942@%3Ccommits.druid.apache.org%3E)

## Related threats

- [kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass](https://junglewise.ai/threats/cve-2025-13281-kube-controller-manager-is-vulnerable-to-half-blind-server-side)
- [A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and…](https://junglewise.ai/threats/cve-2025-57870-a-sql-injection-vulnerability-exists-in-esri-arcgis-server)
- [GO-2025-3915 - Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2025-5187-kubernetes-nodes-can-delete-themselves-by-adding-an-ownerreference)
- [GO-2025-3774 - Kubernetes allows nodes to bypass dynamic resource allocation authorization checks in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2025-4563-kubernetes-allows-nodes-to-bypass-dynamic-resource-allocation)
- [GO-2025-3645 - Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2019-11243-kubernetes-did-not-effectively-clear-service-account-credentials)