Unpatchable Kubernetes SSRF Flaw Exposes Internal Services via API Server Logs

Datadog Security Labs detailed CVE-2020-8561, an unpatchable Kubernetes weakness that can turn the kube-apiserver into a high-impact server-side request forgery (SSRF) proxy. An attacker with valid Kubernetes credentials and elevated privileges, typically cluster-admin, can abuse a ValidatingWebhookConfiguration object to make the API server send requests to attacker-controlled or internal destinations. By combining that behavior with profiling-enabled log-level changes, the attacker can cause the API server to log full responses from those privileged network requests rather than merely confirming whether a port is reachable.

The issue is most dangerous when the Kubernetes control plane sits in a more trusted network segment than worker nodes, including managed Kubernetes environments hosted inside cloud provider networks. Because there is no straightforward code fix, defenders are being urged to reduce exposure through configuration and architecture changes, notably disabling API server profiling with:

--profiling=false

and ensuring that SSRF originating from the API server cannot reach sensitive internal services or metadata endpoints.