--- title: "How Calico Cloud’s runtime defense mitigates Kubernetes MITM vulnerability CVE-2020-8554" source: "https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-calico-clouds-runtime-defense-mitigates-kubernetes-mitm-vulnerability-cve-2020-8554/" description: "Learn how to mitigate the Kubernetes MITM vulnerability CVE-2020-8554 using runtime defense." --- [Technical Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/technical-blog/) # How Calico Cloud’s runtime defense mitigates Kubernetes MITM vulnerability CVE-2020-8554 By [Manoj Ahuje](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/manoj-ahuje/) on Apr 06, 2021 • 4 min read Since the release of CVE-2020-8554 on GitHub this past December, the vulnerability has received widespread attention from industry media and the cloud security community. This man-in-the-middle (MITM) vulnerability affects Kubernetes pods and underlying hosts, and all Kubernetes versions—including future releases—are vulnerable. Despite this, there is currently no patch for the issue. While Kubernetes did [suggest a fix](http://github.com/kubernetes/kubernetes/issues/97076), it only applies to external IPs using an admission webhook controller or an OPA gatekeeper integration, leaving the door open for attackers to exploit other attack vectors (e.g. internet, same VPC cluster, within the cluster). We previously outlined these in [this post](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/new-vulnerability-exposes-kubernetes-to-man-in-the-middle-attacks-heres-how-to-mitigate/). ## Suggested fixes currently on the market Looking at the Kubernetes security market, there are currently a few security solutions that attempt to address CVE-2020-8554. Most of these solutions fall into one or two of three categories: - Detection (using Kubernetes audit logs) - Prevention (using admission webhook controller) - Runtime defense (inline defense) A few of the solutions rely on preventing vulnerable deployments using an OPA gatekeeper integration; these solutions alert users when externalIP (possibly loadBalancerIP) is deployed in their cluster configurations. Most solutions, however, present a dual strategy with a focus on prevention and detection. They use an admission controller for whitelisting externalIP, and Kubernetes audit logs to detect requests to create or patch services with externalIP. While it is easy to detect and prevent the use of externalIP with these approaches, it becomes particularly difficult to do the same with loadBalancerIP. This is because loadBalancerIP is commonly used in Kubernetes clusters, so it easily becomes a big task to separate false positives for this service type. Both of the above approaches rely on the addition of custom configuration and passive detection, which requires monitoring cycles, tracking, incident response, and false positive mitigation for commonly used service types. A more effective strategy would be to mitigate this type of MITM vulnerability at runtime. ## Deploying runtime defense against CVE-2020-8554 By using runtime defense against this vulnerability, organizations don’t need to make any changes to their operation’s workflow or add additional monitoring and enforcement tools. This avoids overhead and saves precious time and resources. [Calico Cloud](https://wordpress-1075849-4005834.cloudwaysapps.com/tigera-products/calico-commercial-editions/)’s runtime defense provides protection for the three types of Kubernetes services (NodePort, LoadBalancer, and ClusterIP) that are vulnerable to CVE-2020-8554. It protects against multiple attack vectors (e.g. internet, same VPC cluster, within the cluster) without the need for additional admission webhook controllers. In the figure below, we show a Kubernetes packet flow through a Kubernetes service. Calico Cloud’s runtime defense works by enforcing policies on flow both pre- and post-DNAT (destination network address translation). This zero-trust network model prevents traffic from being hijacked by malicious entities and provides runtime defense against CVE-2020-8554’s specific class of vulnerability. ![Diagram showing Calico Cloud's pre- and post-DNAT enforcement to protect Kubernetes services from CVE-2020-8554 attacks](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/04/MITM-blog-image-1.png)Calico Cloud runtime defense   ![Calico Cloud runtime defense: Diagram of a man-in-the-middle attack on a crown-pod](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/04/MITM-blog-image-2.png)Inline denied flows to the mitm-pod (shown in red) For prevention, Calico Cloud offers OPA gatekeeper integration to whitelist externalIP or loadBalancerIP. This prevents attackers from using attacker-controlled MITM IPs to modify a service. For detection, Calico Cloud uses signals to detect probable exploit attempts using this vulnerability. We uncovered the subtle use of Kubernetes endpoints with [selectorless services](http://kubernetes.io/docs/concepts/services-networking/service/#headless-services) to exploit the CVE-2020-8554 vulnerability; this is considered an additional indicator of attack (IOA) and is shown in the below alert. ![Calico Cloud detects MITM exploit attempts (CVE-2020-8554) on services by flagging suspicious externalIP/loadBalancerIP](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2021/04/MITM-blog-image-3.png)Calico Cloud MITM threat detection ## Summary When choosing a solution to defend against CVE-2020-8554, DevSecOps and SRE teams should consider the requirements for applying protection at all the layers and constructs of this threat. Calico Cloud takes a unique approach to addressing this vulnerability, using a combination of runtime defense, detection, and prevention. With its Kubernetes-native architecture, Calico Cloud provides a complete security solution to mitigate the Kubernetes MITM vulnerability CVE-2020-8554.   ***To learn more about the latest TTPs being used by threat actors to target Kubernetes clusters, [register for our upcoming webinar](https://wordpress-1075849-4005834.cloudwaysapps.com/event/k8s-compromise-by-latest-ttps/).***   [Products](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/products/)[Kubernetes Vulnerabilities](https://wordpress-1075849-4005834.cloudwaysapps.com/tags/kubernetes-vulnerabilities/) Add Tigera as a preferred source on Google to see more of our content in your search results. [![Add as a preferred source on Google](https://wordpress-1075849-4005834.cloudwaysapps.com/app/themes/tigera2021/dist/img/google-preferred-source-light.png)](https://www.google.com/preferences/source?q=tigera.io) ## Related posts [![The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/The-Rise-of-AI-Agents-and-the-Reinvention-of-Kubernetes.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [Company Blog](https://wordpress-1075849-4005834.cloudwaysapps.com/category/company-blog/) #### [The Rise of AI Agents and the Reinvention of Kubernetes: Ratan Tipirneni’s 2026 Outlook](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) By [Tigera Team](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/marketingtigera-io/) on Dec 30, 2025 Prediction: The next evolution of Kubernetes is not about scale alone, but about intelligence, autonomy, and governance. As part of the article ‘AI and Enterprise Technology Predictions from Industry Experts for 2026′, published by Solutions... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/2026-the-rise-of-ai-agents/) [![How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/12/How-Istio-Ambient-Mode-Delivers-Real-World-Solutions.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) #### [How Istio Ambient Mode Delivers Real World Solutions](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Dec 18, 2025 For years, platform teams have known what a service mesh can provide: strong workload identity, authorization, mutual TLS authentication and encryption, fine-grained traffic control, and deep observability across distributed systems. In theory, Istio checked all... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/how-istio-ambient-mode-delivers-real-world-solutions/) [![A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/app/uploads/2025/11/Blog-A-Detailed-Look-at-the-Calico-Ingress-Gateway.png)](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) #### [A Detailed Look at the Calico Ingress Gateway](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/) By [John Alexander](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/author/john-alexander/) on Nov 20, 2025 The Kubernetes community recently announced that Ingress NGINX, one of the most widely used Ingress controllers, will be retired. This change means teams need to plan for a secure, modern, and future-proof alternative for managing... [Read more](https://wordpress-1075849-4005834.cloudwaysapps.com/blog/a-detailed-look-at-the-calico-ingress-gateway/)