The Kubernetes Security Response Committee (SRC) will update CVE records on June 1, 2026 for three older, unfixed vulnerabilities: CVE-2020-8561 (webhook redirect in kube-apiserver), CVE-2020-8562 (proxy bypass via DNS TOCTOU race condition), and CVE-2021-25740 (cross-namespace forwarding via Endpoints). These CVEs were incorrectly marked as having a fixed version, which caused vulnerability scanners to miss them. Because these are architectural design trade-offs that cannot be fully patched without breaking core functionality, the records will be corrected to reflect that all versions are affected. Administrators are advised to apply specific mitigations: restricting API server log verbosity and disabling profiling for CVE-2020-8561, deploying a local DNS caching resolver for CVE-2020-8562, and auditing RBAC permissions to remove Endpoints write access for CVE-2021-25740.
