--- title: "Understanding unfixed Kubernetes CVEs: What you can and can’t detect" url: https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj source_url: https://www.datadoghq.com/blog/how-to-manage-unfixed-kubernetes-cves type: article source: "Datadog" published: 2026-08-11T07:24:08.491Z updated: 2026-08-24T06:53:43.813Z tags: ["security", "kubernetes"] reading_time: 13 upvotes: 0 comments: 0 language: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Understanding unfixed Kubernetes CVEs: What you can and can’t detect **[Datadog](https://daily.dev/sources/datadog)** · 13 min read · 0 upvotes · 0 comments ## Summary Four older Kubernetes CVEs (CVE-2020-8554, CVE-2021-25740, CVE-2020-8561, CVE-2020-8562) remain unfixed, and a June 2026 update to their records may cause vulnerability scanners to flag clusters that weren't previously reported. An affected version alone doesn't confirm exposure — each CVE requires a specific combination of RBAC permissions, cluster features, and network access. The post walks through how to assess actual exposure conditions for each CVE, provides concrete Kubernetes audit log detection queries (covering Service externalIP changes, endpoint writes, webhook modifications, API server verbosity changes, and blocked Node proxy requests), and explains what audit logs can and cannot confirm. It also recommends documenting exposure assessments per cluster, applying preventive controls like the DenyServiceExternalIPs admission controller, and using additional network/DNS/process logs when audit evidence is insufficient. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How do I detect CVE-2020-8554 exploitation attempts in Kubernetes using audit logs? CVE-2020-8554 has two traffic redirection paths, each requiring a separate detection query. The first query (external_ip_change) checks submitted Service objects or patches for spec.externalIPs — requiring audit policy at Request or RequestResponse level to capture the request body. The second query (load_balancer_status_patch) matches any successful patch to the services/status subresource. The rule triggers when either query matches. _Teams managing Kubernetes security posture track detection patterns like these on daily.dev._ ### Which Kubernetes CVEs remain unfixed and what conditions are required for exploitation? Four Kubernetes CVEs remain unfixed: CVE-2020-8554 (man-in-the-middle via Service traffic redirection, requires Service/Pod create or services/status write access), CVE-2021-25740 (confused deputy via Endpoints/EndpointSlices on selector-less Services), CVE-2020-8561 (webhook-based API server log exfiltration, requires webhook control and verbosity 10 logging), and CVE-2020-8562 (DNS rebinding via Node proxy or StorageClass path). An affected version alone does not confirm exposure. _Kubernetes platform engineers staying ahead of unfixed CVEs find the latest advisories on daily.dev._ ### How can I tell if my Kubernetes cluster is actually exposed to CVE-2021-25740? Exposure to CVE-2021-25740 requires a user who can write Endpoints or EndpointSlices for a selector-less Service, combined with a trusted Ingress or LoadBalancer that may reach backends on the user's behalf. Clusters upgraded from versions before 1.22 are at higher risk because endpoint write permissions were removed from default edit and admin roles only for clusters created at 1.22 — upgraded clusters may retain broader permissions until an administrator audits system:aggregate-to-edit. _Developers navigating Kubernetes upgrade risks and permission audits share findings like this on daily.dev._ ## Similar posts on daily.dev - [Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs](https://daily.dev/posts/reconciling-the-past-correcting-records-for-unfixed-kubernetes-cves-vtna1rmxv) · Kubernetes · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/understanding-unfixed-kubernetes-cves-what-you-can-and-can-t-detect-mrbleofgj)