Vulnerability DatabaseCVE-2020-8565
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2020-8565
Published:December 07, 2020
Updated:September 19, 2026
In Kubernetes, if the logging level is set to at least 9, authorization and bearer tokens will be written to log files. This can occur both in API server logs and client tool output like kubectl. This affects <= v1.19.3, <= v1.18.10, <= v1.17.13, < v1.20.0-alpha2.
Affected Packages
k8s.io/client-go (GO):
Affected version(s) >=v0.19.0 <v0.19.6
Fix Suggestion:
Update to version v0.19.6
k8s.io/client-go (GO):
Affected version(s) >=kubernetes-1.7.6 <v0.17.16
Fix Suggestion:
Update to version v0.17.16
k8s.io/client-go (GO):
Affected version(s) >=v0.18.0 <v0.18.14
Fix Suggestion:
Update to version v0.18.14
k8s.io/client-go (GO):
Affected version(s) >=v0.20.0-alpha.0 <v0.20.0-alpha.2
Fix Suggestion:
Update to version v0.20.0-alpha.2
k8s.io/kubernetes (GO):
Affected version(s) >=v0.0.0-20140620060921-0c8d556afb99 <v1.20.0-alpha.2
Fix Suggestion:
Update to version v1.20.0-alpha.2
Related Resources (11)
https://github.com/kubernetes/client-go/commit/44e1a07f2d513e375c4b6ee6e890040b47befe86
https://pkg.go.dev/vuln/GO-2021-0064
https://github.com/kubernetes/client-go/commit/1b8383fc150c9b816b0072032cca75754c2734d0
https://github.com/kubernetes/client-go/commit/e8f871a2e5fadf90fc114565abc0963967f1a373
https://github.com/kubernetes/kubernetes/issues/95623
https://nvd.nist.gov/vuln/detail/CVE-2020-8565
https://github.com/kubernetes/kubernetes/commit/e99df0e5a75eb6e86123b56d53e9b7ca0fd00419
https://github.com/kubernetes/kubernetes/pull/95316
https://groups.google.com/g/kubernetes-security-discuss/c/vm-HcrFUOCs/m/36utxAM5CwAJ
https://github.com/kubernetes/client-go
https://github.com/kubernetes/client-go/commit/19875a3d5a2e0d4f51c976a9e0662de3c2c011e3
Do you need more information?
Contact Us
CVSS v4
Base Score:
5.7
Attack Vector
LOCAL
Attack Complexity
HIGH
Attack Requirements
NONE
Privileges Required
LOW
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
NONE
Vulnerable System Availability
NONE
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
4.7
Attack Vector
LOCAL
Attack Complexity
HIGH
Privileges Required
LOW
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
NONE
Availability
NONE
Weakness Type (CWE)
Insertion of Sensitive Information into Log File
CWE-532
EPSS
Base Score:
0.52