Root on a Kubernetes Node Can Spoof cgroups to Steal Co-located Workloads' SPIFFE/SPIRE Identities

Palo Alto Networks Unit 42 detailed a post-exploitation technique in which an attacker with root access to a Kubernetes node spoofs cgroup selectors so the local SPIRE agent issues valid SVIDs of co-located workloads to attacker-controlled processes, enabling…

Palo Alto Networks Unit 42 researchers described a post-exploitation technique targeting SPIFFE/SPIRE workload identity deployments in Kubernetes. An attacker who gains root access to a node manipulates Linux cgroup metadata (forging cgroup paths/selectors) so the local SPIRE agent matches a target pod's selectors and issues that workload's SVID to an attacker-controlled process. Stolen X.509 or JWT SVIDs let the attacker impersonate victim applications over mutual TLS or pass identity-aware authorization checks, turning a single node compromise into lateral movement and privilege escalation. The technique undermines SPIFFE/SPIRE's assumption of node trustworthiness, meaning every workload identity on a compromised node should be considered exposed. Unit 42 said it has not observed exploitation in the wild and released the open-source Spooffe tool so defenders can measure which SVIDs are harvestable per node. Recommended mitigations include hardening nodes, restricting privileged containers and root access, avoiding overly broad workload selectors, and isolating high-value workloads.

• Root compromise of a Kubernetes node exposes every workload identity issued to workloads on that node, defeating SPIFFE/SPIRE workload identity separation.
• Attackers spoof cgroup paths/selectors so the local SPIRE agent matches a target pod's selectors and issues its SVID to an attacker-controlled process.
• Stolen SVIDs can be X.509 or JWT and enable mTLS impersonation and identity-based authorization bypass for lateral movement and privilege escalation.
• The technique is post-exploitation, not a remote flaw, and Unit 42 has not observed it exploited in the wild.
• Unit 42 released Spooffe, an open-source tool to test which SVIDs are harvestable per node.
• Both reports were published on 2026-09-17 (GBHackers and Cyber Security News, both citing Unit 42 research).
• Defenders are urged to harden nodes, restrict privileged containers and root access, avoid overly broad workload selectors, and isolate high-value workloads.