One Compromised Kubernetes Node Can Expose Every Workload Identity Running on It
Unit42 researchers show a root attacker on a Kubernetes node can manipulate cgroups to make the local SPIRE agent issue other workloads' identities.
Palo Alto Networks Unit42 demonstrated that an attacker with root access on a Kubernetes node can alter Linux cgroup data so the local SPIRE agent matches a target pod's selectors and issues its SVID to an attacker-controlled process. The technique affects SPIFFE/SPIRE deployments, which assume node trustworthiness, and means every workload identity on a compromised node should be considered exposed. Researchers have not observed the method in the wild and released Spooffe, a testing tool to measure node identity exposure.
- Root on a node defeats SPIFFE/SPIRE workload identity separation
- Attacker forges cgroup paths to obtain co-located workloads' SVIDs
- Technique is post-exploitation, not a remote flaw; not seen in the wild
- Unit42 released Spooffe to test identity exposure on nodes
- Defenders urged to isolate high-value workloads and restrict root access
- Vendors
- Palo Alto Networks
- Products
- KubernetesSPIFFESPIRESpooffe
- Organizations
- Unit42
From the original article
3 min read at cybersecuritynews.com
A Kubernetes node becomes an identity breach point when an attacker gains root access. Research shows a hostile process can impersonate other workloads and obtain their credentials, turning one foothold into wider access across a shared node. The issue affects SPIFFE and SPIRE deployments, which replace long-lived secrets with short-lived workload identities.
By Tushar Subhra Dutta · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.