One Compromised Kubernetes Node Can Expose Every Workload Identity Running on It
Unit42 researchers show a root attacker on a Kubernetes node can manipulate cgroups to make the local SPIRE agent issue other workloads' identities.
52
Product
SPIFFE
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 10, 2026
- Last mentionedSep 17, 2026
Timeline
3 articles · newest firstKubernetes Attack Lets Hackers Steal SPIFFE Workload Identities and Impersonate Applications
Unit 42 detailed a Kubernetes technique where node-root attackers spoof cgroup selectors to steal SPIFFE/SPIRE workload identities and impersonate applications.
45
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE
Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.
45
Appears with
- Kubernetesproduct · 3
- SPIREproduct · 3
- Spooffeproduct · 3
- Palo Alto Networksvendor · 3
- Unit 42organization · 2
- Cortex Cloudproduct · 1
- Unit42organization · 1
- Cortex XDRproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.