Loading vulnerability…
A vulnerability in Kubernetes kubelet and kube-proxy affects versions 1.1.0-1.16.10, 1.17.0-1.17.6, and 1.18.0-1.18.3. Due to incorrect handling of localhost routing behavior in Linux container networking, adjacent hosts on the same LAN/layer-2 domain, as well as containers running on the same node, can reach TCP and UDP services bound only to 127.0.0.1 on the node or within the node's network namespace. Services that operators expect to be accessible only from the local host may therefore become reachable from unintended origins. This is effectively a localhost access-control boundary bypass in kubelet/kube-proxy networking behavior.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
2 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos.
This repository is a proof-of-concept (PoC) exploit for CVE-2020-8558, a vulnerability in Kubernetes kube-proxy that allows bypassing the pod-to-node localhost boundary. The exploit is implemented in Python and is designed to be run from within a Kubernetes pod, using the provided Dockerfile and pod manifest (kube/pod.yaml). The main exploit logic is in martian_packets/main.py, which crafts and sends raw TCP packets to the node's localhost (127.0.0.1:8080), targeting the unauthenticated kube-apiserver REST API. If successful, it creates a new pod named 'youve-been-pwned' in the default namespace, demonstrating the ability to reach internal services from a pod. The repository includes custom packet crafting and exchange logic (martian_packets/packets/tcp_craft.py and tcp_exchange.py), and a shell script (start.sh) to ensure network readiness before launching the exploit. No hardcoded IPs are used; the pod and node IPs are dynamically set via environment variables. The exploit demonstrates a network-based attack vector and is a functional PoC for Kubernetes environments vulnerable to CVE-2020-8558.
This repository provides a proof-of-concept (PoC) and a test script for exploiting CVE-2020-8558, a design flaw in Kubernetes kube-proxy that allows remote access to services bound to localhost (127.0.0.1) on a vulnerable node. The repository contains two main Python scripts: - poc-2020-8558.py: The main exploit script, which acts as a proxy to rewrite and forward packets, enabling arbitrary TCP/UDP clients to communicate with services on the target's localhost interface. It uses scapy to manipulate raw packets, redirecting traffic from a fake IP (default 198.51.100.1) to 127.0.0.1 on the target node, and vice versa. - tst-2020-8558.py: A test script that sends a SYN packet to 127.0.0.1 on the target via the vulnerable routing and checks for a response, indicating whether the target is exploitable. The Dockerfile sets up an environment with the necessary dependencies (scapy, kubectl, tcpdump) and installs the scripts. The README provides detailed background on the vulnerability, exploitation method, and mitigation. The exploit requires the attacker to have network access to the target node and for the node to be running a vulnerable version/configuration of kube-proxy. No hardcoded credentials or specific service endpoints are present, but the scripts target the 127.0.0.1 address on the victim node. The exploit is a PoC and does not provide a weaponized or automated payload, but demonstrates the impact of the vulnerability.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.