# CVE-2020-8561: Kubernetes kube-apiserver confused deputy in webhook configurations

Source: https://junglewise.ai/threats/cve-2020-8561-kubernetes-kube-apiserver-confused-deputy-in-webhook  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2021-09-21. Updated: 2026-06-09  
License: CC BY 4.0 with a link back

CVE-2020-8561 · Severity: medium · CVSS 4.1 · Published 2021-09-21

A security vulnerability exists in Kubernetes where administrative users who manage webhook configurations can trick the system into sending requests to internal, private networks. If these users also have access to system logs while high-detail logging is enabled, they could potentially view sensitive data from those internal responses. This could lead to the exposure of internal service information or credentials that are otherwise protected from external access.

Technologies: [k8s.io/kubernetes (Go)](https://junglewise.ai/threats/technologies/k8s-io-kubernetes), [Kubernetes](https://junglewise.ai/threats/technologies/kubernetes). Vendors: [Go](https://junglewise.ai/threats/vendors/go), [Kubernetes](https://junglewise.ai/threats/vendors/kubernetes).

## Quick answers

**Is CVE-2020-8561 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2020-8561 being exploited in the wild.

**How severe is CVE-2020-8561?** Medium severity, with a CVSS score of 4.1, published 21 September 2021.

**Which products and versions are affected?** k8s.io/kubernetes (Go) <= 1.22.2, SEMVER:introduced=0,last_affected=1.22.2; Kubernetes <= 1.22.2.

**Is there a fix for CVE-2020-8561?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2020-8561 attacked?** It is attacked over the network, in an operating system.

**Am I affected by CVE-2020-8561?** Check whether you run k8s.io/kubernetes (Go) or Kubernetes at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A 'Confused Deputy' vulnerability (CWE-441) exists in the Kubernetes kube-apiserver. Attackers with high privileges who can control MutatingWebhookConfiguration or ValidatingWebhookConfiguration responses can redirect kube-apiserver requests to the apiserver's private networks. If the attacker also has permission to view kube-apiserver logs and the log level is set to 10 (extreme debug), they can capture redirected response bodies and headers. The vulnerability is exacerbated if profiling is enabled, as it may allow dynamic modification of log levels. No official patch is available; mitigation involves restricting apiserver network access, disabling profiling, and maintaining log levels below 10.

## Affected products

- Kubernetes Kubernetes <= 1.22.2

## Identifiers

- CVE-2020-8561
- GHSA-74j8-88mm-7496

## Timeline

- 2020-08-28: other: CVE reserved date
- 2021-09-01: disclosed: Issue opened in Kubernetes GitHub repository
- 2021-09-21: advisory: GitHub Advisory published

## References

- [https://github.com/kubernetes/kubernetes/issues/104720](https://github.com/kubernetes/kubernetes/issues/104720)
- [https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY](https://groups.google.com/g/kubernetes-security-announce/c/RV2IhwcrQsY)
- [https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves](https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves)
- [https://security.netapp.com/advisory/ntap-20211014-0002](https://security.netapp.com/advisory/ntap-20211014-0002)

## Related threats

- [kube-controller-manager is vulnerable to half-blind Server Side Request Forgery through in-tree Portworx StorageClass](https://junglewise.ai/threats/cve-2025-13281-kube-controller-manager-is-vulnerable-to-half-blind-server-side)
- [A SQL Injection vulnerability exists in Esri ArcGIS Server versions 11.3, 11.4 and 11.5 on Windows, Linux and…](https://junglewise.ai/threats/cve-2025-57870-a-sql-injection-vulnerability-exists-in-esri-arcgis-server)
- [GO-2025-3915 - Kubernetes Nodes can delete themselves by adding an OwnerReference in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2025-5187-kubernetes-nodes-can-delete-themselves-by-adding-an-ownerreference)
- [GO-2025-3774 - Kubernetes allows nodes to bypass dynamic resource allocation authorization checks in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2025-4563-kubernetes-allows-nodes-to-bypass-dynamic-resource-allocation)
- [GO-2025-3645 - Kubernetes did not effectively clear service account credentials in k8s.io/kubernetes](https://junglewise.ai/threats/cve-2019-11243-kubernetes-did-not-effectively-clear-service-account-credentials)