Reconciling the Past: Correcting Records for Unfixed Kubernetes CVEs
The Kubernetes project says CVE records for three older vulnerabilities (CVE-2020-8561, CVE-2020-8562, CVE-2021-25740) incorrectly listed a fixed version. The Security Response Committee will correct the records on June 1, 2026, marking them as unfixed and affecting all versions. The project says the issues are architectural trade-offs it will not fix in code, and it lists configuration mitigations for each.
What changes for platform teams
Vulnerability scanners may start flagging these issues on clusters that were previously clean, so platform teams should expect new findings. Teams should apply the listed mitigations, including log verbosity and profiling settings, a caching DNS resolver on control plane nodes, and an RBAC audit to remove Endpoints write access from broad roles.
Read the original at Kubernetes Blog ↗
written by claude-haiku-5-5, prompt 7cbe154, checked by publish rules