Three unresolved vulnerabilities in Kubernetes have remained unpatched, with the Security Response Committee announcing plans to correct affected CVE records on June 1, 2026.
What happened
The Kubernetes Security Response Committee has confirmed it will update CVE records for three unfixed vulnerabilities—CVE-2020-8561, CVE-2020-8562, and CVE-2021-25740—on June 1, 2026. Current CVE records for older unfixed issues incorrectly include a fixed version field, which may mislead users about remediation status.
Key details
The vulnerabilities identified are described as architectural design trade-offs that cannot be fully remediated without breaking Kubernetes functionality. This means no patch or configuration change can fully eliminate the risks without altering core system behaviour. The correction of CVE records will address inaccuracies in existing documentation but will not resolve the underlying issues.
Sources
Primary and supporting sources used for this report.