CVE-2020-10749

MEDIUM

containernetworking/plugins <0.8.6 - Privilege Escalation

Title source: llm
STIX 2.1

Description

A vulnerability was found in all versions of containernetworking/plugins before version 0.8.6, that allows malicious containers in Kubernetes clusters to perform man-in-the-middle (MitM) attacks. A malicious container can exploit this flaw by sending rogue IPv6 router advertisements to the host or other containers, to redirect traffic to the malicious container.

Exploits (1)

nomisec WORKING POC 25 stars
by knqyf263 · poc
https://github.com/knqyf263/CVE-2020-10749

References (5)

Core 5
Core References
Issue Tracking, Third Party Advisory x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2020-10749
Broken Link, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00063.html
Broken Link, Third Party Advisory vendor-advisory x_refsource_suse
http://lists.opensuse.org/opensuse-security-announce/2020-07/msg00065.html

Scores

CVSS v3 6.0
EPSS 0.0519
EPSS Percentile 90.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L

Details

CWE
CWE-300
Status published
Products (6)
containernetworking/plugins 0 - 0.8.6Go
fedoraproject/fedora 32
linuxfoundation/cni_network_plugins < 0.8.6
redhat/enterprise_linux 7.0
redhat/enterprise_linux 8.0
redhat/openshift_container_platform 4.0
Published Jun 03, 2020
Tracked Since Feb 18, 2026