{"cve":"CVE-2020-8569","nvd":{"published":"2021-01-21T17:15:14.250","modified":"2026-06-17T03:26:34.210","status":"Modified","description":"Kubernetes CSI snapshot-controller prior to v2.1.3 and v3.0.2 could panic when processing a VolumeSnapshot custom resource when: - The VolumeSnapshot referenced a non-existing PersistentVolumeClaim and the VolumeSnapshot did not reference any VolumeSnapshotClass. - The snapshot-controller crashes, is automatically restarted by Kubernetes, and processes the same VolumeSnapshot custom resource after the restart, entering an endless crashloop. Only the volume snapshot feature is affected by this vulnerability. When exploited, users can’t take snapshots of their volumes or delete the snapshots. All other Kubernetes functionality is not affected.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","score":6.5},"cwes":["CWE-476"],"references":["https://github.com/kubernetes-csi/external-snapshotter/issues/380","https://groups.google.com/g/kubernetes-security-announce/c/1EzCr1qUxxU","https://github.com/kubernetes-csi/external-snapshotter/issues/380","https://groups.google.com/g/kubernetes-security-announce/c/1EzCr1qUxxU"],"products":["kubernetes:container_storage_interface_snapshotter"],"source":"nvd","synced_at":"2026-10-19T21:14:10.479542811+00:00"},"epss":{"cve":"CVE-2020-8569","score":0.02212,"percentile":0.82613,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-hwrr-rhmm-vcvf","url":"https://osv.dev/vulnerability/GHSA-hwrr-rhmm-vcvf","summary":"NULL Pointer Dereference in Kubernetes CSI snapshot-controller","modified":"2023-11-08T04:04:17.423885Z","packages":[{"ecosystem":"Go","name":"github.com/kubernetes-csi/external-snapshotter/v2","purl":"pkg:golang/github.com/kubernetes-csi/external-snapshotter/v2","ranges":[">=2.0.0 <2.1.3"],"fixed":["2.1.3"]},{"ecosystem":"Go","name":"github.com/kubernetes-csi/external-snapshotter/v3","purl":"pkg:golang/github.com/kubernetes-csi/external-snapshotter/v3","ranges":[">=3.0.0 <3.0.2"],"fixed":["3.0.2"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}