--- title: Understanding unfixed Kubernetes CVEs: What you can and... description: Four older Kubernetes CVEs (CVE-2020-8554, CVE-2021-25740, CVE-2020-8561, CVE-2020-8562) remain unfixed, and a June 2026 update to their records may cause... canonical: https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Understanding unfixed Kubernetes CVEs: What you can and can’t detect | daily.dev og:description: Four older Kubernetes CVEs (CVE-2020-8554, CVE-2021-25740, CVE-2020-8561, CVE-2020-8562) remain unfixed, and a June 2026 update to their records may cause... og:url: https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj og:image: https://api.daily.dev/og/posts/MrbLEOFgJ.png og:image:alt: Understanding unfixed Kubernetes CVEs: What you can and can’t detect og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Understanding unfixed Kubernetes CVEs: What you can and can’t detect **[Datadog](https://daily.dev/sources/datadog)** · 13 min read · 0 upvotes · 0 comments ## Summary Four older Kubernetes CVEs (CVE-2020-8554, CVE-2021-25740, CVE-2020-8561, CVE-2020-8562) remain unfixed, and a June 2026 update to their records may cause vulnerability scanners to flag clusters that weren't previously reported. An affected version alone doesn't confirm exposure — each CVE requires a specific combination of RBAC permissions, cluster features, and network access. The post walks through how to assess actual exposure conditions for each CVE, provides concrete Kubernetes audit log detection queries (covering Service externalIP changes, endpoint writes, webhook modifications, API server verbosity changes, and blocked Node proxy requests), and explains what audit logs can and cannot confirm. It also recommends documenting exposure assessments per cluster, applying preventive controls like the DenyServiceExternalIPs admission controller, and using additional network/DNS/process logs when audit evidence is insufficient. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### Why did my Kubernetes vulnerability scanner suddenly start reporting old CVEs like CVE-2020-8554 that it never flagged before? On June 1, 2026, the Kubernetes Security Response Committee updated the records for four older, unfixed CVEs (CVE-2020-8554, CVE-2021-25740, CVE-2020-8561, CVE-2020-8562), which can cause scanners to newly report them in clusters running affected versions. An affected version alone does not mean a cluster is actually exposed; exploitation depends on specific permissions, cluster features, and network access being present. _Teams triaging fresh scanner alerts on old Kubernetes CVEs can track exposure-condition guidance like this via daily.dev._ ### How can I detect exploitation attempts of CVE-2020-8554 using Kubernetes audit logs? Detection requires monitoring two traffic redirection paths: changes to a Service's spec.externalIPs field and patches to the services/status subresource that alter status.loadBalancer.ingress.ip. The externalIPs check requires audit logging at the Request or RequestResponse level to capture the submitted body, while the services/status query matches any successful patch since the specific field changed isn't recorded. Restricting who can modify Services and Pods and disabling the field via the DenyServiceExternalIPs admission controller reduces exposure. _Kubernetes security engineers tracking CVE detection techniques can follow deep dives like this on daily.dev._ ### Can Kubernetes audit logs fully confirm exploitation of CVE-2020-8562 DNS rebinding attacks? No, audit logs cannot confirm successful DNS rebinding exploitation for CVE-2020-8562; they can only show when address validation blocks a proxy request with an 'address not allowed' response. Confirming an actual attack requires comparing DNS query logs for the resolver used by kube-apiserver to check whether a hostname resolved differently between validation and connection lookups, or using Konnectivity to keep proxy traffic off the control plane network. _Practitioners weighing what audit logs can and can't prove for unpatchable CVEs can find this kind of nuance on daily.dev._ ## Similar posts on daily.dev - [Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs](https://daily.dev/posts/reconciling-the-past-correcting-records-for-unfixed-kubernetes-cves-vtna1rmxv) · Kubernetes · 0 upvotes · 0 comments - [A Brief Deep-Dive into Attacking and Defending Kubernetes](https://daily.dev/posts/a-brief-deep-dive-into-attacking-and-defending-kubernetes-vxcbvujil) · Tech Lead Digest · 5 upvotes · 0 comments - [Best of 2025: CVE-2025-1097, CVE-2025-1098, CVE-2025-1974, CVE-2025-24513, CVE-2025-24514: Frequently Asked Questions About IngressNightmare](https://daily.dev/posts/best-of-2025-cve-2025-1097-cve-2025-1098-cve-2025-1974-cve-2025-24513-cve-2025-24514-frequentl-c4yvmwhfq) · Security Boulevard · 1 upvotes · 0 comments - [July 2026 CVE Landscape](https://daily.dev/posts/july-2026-cve-landscape-iupqvq66f) · Recorded Future Blog · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Understanding unfixed Kubernetes CVEs: What you can and can’t detect","url":"https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj"},"datePublished":"2026-08-11T07:24:08.491Z","dateModified":"2026-09-13T20:20:45.816Z","description":"Four older Kubernetes CVEs (CVE-2020-8554, CVE-2021-25740, CVE-2020-8561, CVE-2020-8562) remain unfixed, and a June 2026 update to their records may cause...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/47405af9bc47568e4aff0f064307d4eb?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/47405af9bc47568e4aff0f064307d4eb?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Datadog","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Datadog","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/8f9d7e3e4bd64bd7b9db9b2ea83e0c6a","url":"https://daily.dev/sources/datadog"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,kubernetes","timeRequired":"PT13M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Datadog","item":"https://daily.dev/sources/datadog"},{"@type":"ListItem","position":3,"name":"Understanding unfixed Kubernetes CVEs: What you can and can’t detect"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj#faq","mainEntity":[{"@type":"Question","name":"Why did my Kubernetes vulnerability scanner suddenly start reporting old CVEs like CVE-2020-8554 that it never flagged before?","acceptedAnswer":{"@type":"Answer","text":"On June 1, 2026, the Kubernetes Security Response Committee updated the records for four older, unfixed CVEs (CVE-2020-8554, CVE-2021-25740, CVE-2020-8561, CVE-2020-8562), which can cause scanners to newly report them in clusters running affected versions. An affected version alone does not mean a cluster is actually exposed; exploitation depends on specific permissions, cluster features, and network access being present. Teams triaging fresh scanner alerts on old Kubernetes CVEs can track exposure-condition guidance like this via daily.dev."}},{"@type":"Question","name":"How can I detect exploitation attempts of CVE-2020-8554 using Kubernetes audit logs?","acceptedAnswer":{"@type":"Answer","text":"Detection requires monitoring two traffic redirection paths: changes to a Service's spec.externalIPs field and patches to the services/status subresource that alter status.loadBalancer.ingress.ip. The externalIPs check requires audit logging at the Request or RequestResponse level to capture the submitted body, while the services/status query matches any successful patch since the specific field changed isn't recorded. Restricting who can modify Services and Pods and disabling the field via the DenyServiceExternalIPs admission controller reduces exposure. Kubernetes security engineers tracking CVE detection techniques can follow deep dives like this on daily.dev."}},{"@type":"Question","name":"Can Kubernetes audit logs fully confirm exploitation of CVE-2020-8562 DNS rebinding attacks?","acceptedAnswer":{"@type":"Answer","text":"No, audit logs cannot confirm successful DNS rebinding exploitation for CVE-2020-8562; they can only show when address validation blocks a proxy request with an 'address not allowed' response. Confirming an actual attack requires comparing DNS query logs for the resolver used by kube-apiserver to check whether a hostname resolved differently between validation and connection lookups, or using Konnectivity to keep proxy traffic off the control plane network. Practitioners weighing what audit logs can and can't prove for unpatchable CVEs can find this kind of nuance on daily.dev."}}]} ```