CVE-2026-20770: Medium severity Cluster Management Toolkit for Kubernetes vulnerability
Protection mechanism failure for some Cluster Management Toolkit for Kubernetes software before version v0.8.5 within Ring 3: User Applications may allow an escalation of privilege. System software adversary with a privileged user combined with a low complexity attack may enable escalation of privilege. This result may potentially occur via local access when attack requirements are present without special internal knowledge and requires passive user interaction. The potential vulnerability may impact the confidentiality (high), integrity (high) and availability (high) of the vulnerable system, resulting in subsequent system confidentiality (none), integrity (none) and availability (none) impacts.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Cluster Management Toolkit for Kubernetesto a version that resolves this vulnerability.Fixed in 0.8.5 - Compensating control
Limit or remove local/privileged user access pathways to the Cluster Management Toolkit for Kubernetes environment (ring 3 user application context), until it is upgraded to v0.8.5 or later.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-20770?
The severity of CVE-2026-20770 is rated as 45.
What type of vulnerability is CVE-2026-20770?
CVE-2026-20770 is classified as a protection mechanism failure vulnerability that may lead to privilege escalation.
How can I mitigate the risk of CVE-2026-20770?
To mitigate the risk of CVE-2026-20770, upgrade to Cluster Management Toolkit for Kubernetes version v0.8.5 or later.
Who is affected by CVE-2026-20770?
CVE-2026-20770 affects users of Cluster Management Toolkit for Kubernetes software versions prior to v0.8.5.
What actions can an attacker take if CVE-2026-20770 is exploited?
If exploited, CVE-2026-20770 allows a system software adversary with privileged access to escalate their privilege.