Potential proxy IP restriction bypass in Kubernetes
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.
02 / AFFECTED SOFTWARE
Affected packages
178 explicit affected versions
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.
(This report has been withdrawn from the Go vulnerability database with reason: "Low severity issue with no fix available or planned. Likely to cause false positives.").
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane.
05 / REFERENCES
Further evidence
- https://github.com/kubernetes/kubernetes
- https://github.com/kubernetes/kubernetes/issues/101493
- https://github.com/kubernetes/kubernetes/issues/101493#issuecomment-2272095629
- https://groups.google.com/g/kubernetes-security-announce/c/-MFX60_wdOY
- https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves
- https://nvd.nist.gov/vuln/detail/CVE-2020-8562
- https://security.netapp.com/advisory/ntap-20220225-0002
- https://github.com/advisories/GHSA-qh36-44jv-c8xj
- https://kubernetes.io/blog/2026/05/26/reconciling-unfixed-kubernetes-cves/
- https://security.netapp.com/advisory/ntap-20220225-0002/