As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.
Monitor this advisory for an available fix and review any installs of the affected package.
Local check
hol-guard supply-chain scanPotential proxy IP restriction bypass in Kubernetes affects k8s.io/kubernetes (go), k8s.io/kubernetes (go), k8s.io/kubernetes (go), k8s.io/kubernetes (go). Severity is low. As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.
AI coding agents often install or upgrade packages automatically in go. A low vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|
As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.
Monitor this advisory for an available fix and review any installs of the affected package.
Local check
hol-guard supply-chain scanPotential proxy IP restriction bypass in Kubernetes affects k8s.io/kubernetes (go), k8s.io/kubernetes (go), k8s.io/kubernetes (go), k8s.io/kubernetes (go). Severity is low. As mitigations to a report from 2019 and CVE-2020-8555, Kubernetes attempts to prevent proxied connections from accessing link-local or localhost networks when making user-driven connections to Services, Pods, Nodes, or StorageClass service providers. As part of this mitigation Kubernetes does a DNS name resolution check and validates that response IPs are not in the link-local (169.254.0.0/16) or localhost (127.0.0.0/8) range. Kubernetes then performs a second DNS resolution without validation for the actual connection. If a non-standard DNS server returns different non-cached responses, a user may be able to bypass the proxy IP restriction and access private networks on the control plane. All versions of Kubernetes are impacted, and there is no fix in place.
AI coding agents often install or upgrade packages automatically in go. A low vulnerability in a dependency can be pulled into a project through a normal install or update without a human reviewing the change, expanding the blast radius from a single package to every agent workspace that depends on it.
| Package | Affected range | Fixed version |
|---|
| k8s.io/kubernetesgo | >=1.21.0,<=1.21.1 | Not reported |
|---|
| k8s.io/kubernetesgo | >=1.20.0,<=1.20.7 | Not reported |
|---|
| k8s.io/kubernetesgo | >=1.19.0,<=1.19.11 | Not reported |
|---|
| k8s.io/kubernetesgo | <=1.18.19 | Not reported |
|---|
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard| k8s.io/kubernetesgo | >=1.21.0,<=1.21.1 | Not reported |
|---|
| k8s.io/kubernetesgo | >=1.20.0,<=1.20.7 | Not reported |
|---|
| k8s.io/kubernetesgo | >=1.19.0,<=1.19.11 | Not reported |
|---|
| k8s.io/kubernetesgo | <=1.18.19 | Not reported |
|---|
Reported by GitHub Security Advisories (ghsa).
HOL Guard can help your team review package activity against supported protection paths.
Explore HOL Guard