The Kubernetes Security Response Committee (SRC) has identified discrepancies in CVE records for several older, unfixed vulnerabilities. Some records incorrectly listed a fixed version, leading to potential false negatives in automated security scanning. As of June 1, 2026, the SRC is correcting these records to accurately reflect that these issues remain unresolved due to fundamental architectural constraints.
The root cause of the discrepancy stems from the generation of official Open Source Vulnerabilities (OSV) files. Some CVE records falsely claimed a fix existed. In reality, these are architectural design trade-offs that cannot be fully remediated through code without breaking core Kubernetes functionality. The SRC emphasizes that correcting these records is vital for automation fidelity (ensuring scanners detect real risks) and risk documentation (clarifying the need for administrative mitigations).
Unfixed Vulnerabilities and Mitigations
The following vulnerabilities will not be fixed by the Kubernetes project. The technical details below describe the flaws and the recommended mitigations.
CVE-2020-8561: Webhook Redirect in kube-apiserver
Severity: Medium (4.1)
The Issue: The kube-apiserver follows HTTP redirects when communicating with admission webhooks. An actor capable of configuring an AdmissionWebhookConfiguration can redirect API server requests to internal, private networks.
Why it remains unfixed: Restricting this behavior would require breaking the standard HTTP client behavior that many legitimate integrations rely on.
Mitigation: The vendor recommends securing the environment by setting the API server log level to less than 10 (to prevent logging response bodies) and disabling dynamic profiling.
--v < 10
--profiling=false
CVE-2020-8562: Proxy Bypass via DNS TOCTOU
Severity: Low (3.1)
The Issue: A Time-of-Check to Time-of-Use (TOCTOU) race condition in the API server proxy allows users to bypass IP restrictions. The system performs a DNS check to validate an IP, but then performs a second resolution for the actual connection, which an attacker can manipulate.
Why it remains unfixed: Fixing this requires pinning resolved IPs in a way that breaks complex split-horizon DNS or dynamic IP environments.
Mitigation: Use a local DNS caching server like dnsmasq for the API server and configure min-cache-ttl to enforce consistent responses between the check and the connection.
CVE-2021-25740: Cross-Namespace Forwarding via Endpoints
Severity: Low (3.1)
The Issue: A design flaw in the Endpoints and EndpointSlice API objects allows users to manually specify IP addresses, which can be used to point a LoadBalancer or Ingress toward backends in other namespaces.
Why it remains unfixed: This is a fundamental feature of the Endpoints API used by many networking tools and operators.
Mitigation: Restrict write access to Endpoints (legacy) and EndpointSlices. Since Kubernetes 1.22, RBAC authorization mode no longer includes those permissions in the default edit and admin ClusterRoles. Administrators should run the following command to reconcile permissions:
kubectl auth reconcile
CVE-2020-8554: ExternalIP Interception
Note: This is an unfixed CVE with a correct record stating it affects all versions. The record will be updated to use a more standardized version number format.
The Issue: An attacker who can create a ClusterIP service and set the spec.externalIPs field can intercept traffic to that IP address. An attacker who can patch the status of a LoadBalancer service can also set the status.loadBalancer.ingress.ip to achieve a similar effect.
Required Actions for Administrators
The Kubernetes project recommends a secure-by-configuration approach to manage these persistent risks:
| Vulnerability | Action Item | Severity | Command / Configuration |
|---|---|---|---|
Administrators should independently test and validate these configurations in a non-production environment, assessing the architectural risks against their specific threat model and risk tolerance.
Conclusion
The effort to reconcile these records represents a maturing security ecosystem. By moving away from a “patch-only” mindset and accurately documenting architectural debt, the Kubernetes project provides the community with high-fidelity data needed to secure modern cloud-native infrastructure.