CVE-2020-10749: 
Grafana vulnerability analysis and mitigation

A vulnerability (CVE-2020-10749) was discovered in containernetworking/plugins versions prior to 0.8.6, affecting Kubernetes clusters. The vulnerability allows malicious containers to perform man-in-the-middle (MitM) attacks by exploiting IPv6 router advertisements. This security issue was discovered and disclosed in May 2020, affecting various container networking implementations and Kubernetes deployments (NVD, Red Hat).

The vulnerability exists in the CNI network plugins that create network bridges that accept IPv6 router advertisements by default. The issue has a CVSS v3.1 base score of 6.0 (Medium), with the vector string CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:L/A:L. The vulnerability allows an attacker with code execution capabilities in a container to send rogue IPv6 router advertisements to the host or other containers, potentially redirecting traffic to a malicious container (NVD, Red Hat Bugzilla).

The successful exploitation of this vulnerability could allow attackers to perform man-in-the-middle attacks against the host network or other containers on the same host. This could lead to interception and potential modification of network traffic between containers or between containers and the host (NVD).

The vulnerability requires an attacker to have the ability to execute code within a container in the Kubernetes cluster. The attack can be performed by sending rogue IPv6 router advertisements, which can redirect traffic to a malicious container. The vulnerability is particularly concerning in IPv4 clusters where IPv6 traffic might not be explicitly controlled (Red Hat Bugzilla).

The primary mitigation is to upgrade containernetworking/plugins to version 0.8.6 or later, which includes the fix for this vulnerability. As a workaround, organizations can prevent untrusted, non-privileged containers from running with CAP_NET_RAW capability. For OpenShift users, it's noted that in OpenShift Container Platform 4, the default network plugins (OpenShift SDN and OVN Kubernetes) do not forward IPv6 traffic, making this vulnerability not exploitable in default configurations (Red Hat Bugzilla, SUSE).