One Compromised Kubernetes Node Can Expose Every Workload Identity Running on It
Unit42 researchers show a root attacker on a Kubernetes node can manipulate cgroups to make the local SPIRE agent issue other workloads' identities.
Palo Alto Networks Unit42 demonstrated that an attacker with root access on a Kubernetes node can alter Linux cgroup data so the local SPIRE agent matches a target pod's selectors and issues its SVID to an attacker-controlled process. The technique affects SPIFFE/SPIRE deployments, which assume node trustworthiness, and means every workload identity on a compromised node should be considered exposed. Researchers have not observed the method in the wild and released Spooffe, a testing tool to measure node identity exposure.
52