tag: Kubernetes · 4 items
- Engineer — Plan: If you run Dell Container Storage Modules to connect Dell storage arrays to Kubernetes, patch to the fixed CSM release promptly — max severity means admin-privilege exposure, though no public PoC or KEV listing has been confirmed yet.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: Kubernetes operators routinely accumulate excessive cluster-admin-level RBAC that expands blast radius if compromised; evaluate and run OperTraitor against your clusters this quarter to audit operator service account permissions and remediate over-privileged non-human identities.
- SOC/IR — Skip
- Leader — Skip
- Engineer — Plan: GKE users running Config Connector should audit the service account’s IAM permissions and restrict who can submit YAML to affected clusters — a limited K8s principal could escalate to GCP org-level access via the connector’s delegated authority. No public PoC or active exploitation, but the attack path is now documented; tighten Config Connector RBAC and review org-level bindings this quarter.
- SOC/IR — Learn: A new confused-deputy escalation path from K8s YAML to GCP org control is worth adding to the analyst mental model for GKE environments, but there are no IOCs or active campaigns to hunt. File as a technique to watch if hunting lateral movement in GCP-connected clusters.
- Leader — Skip
- Engineer — Learn: Research details how node-level root access lets an attacker abuse SPIFFE/SPIRE to harvest SVIDs for co-located workloads, effectively pivoting laterally using stolen workload identities. No CVE or configuration fix is available, but teams running SPIFFE/SPIRE on Kubernetes should review node isolation boundaries and treat node compromise as full workload-identity compromise for that host.
- SOC/IR — Plan: This documents a concrete post-exploitation TTP: harvesting co-located SPIFFE SVIDs after gaining K8s node root; worth building detections for anomalous SPIFFE/SPIRE API calls or unexpected workload identity usage patterns this quarter if your estate includes SPIRE-enabled clusters.
- Leader — Learn: Technical research on workload identity abuse in Kubernetes with no active exploitation signal; useful context for understanding the blast radius of a compromised K8s node in environments that rely on SPIFFE/SPIRE for zero-trust workload auth, but requires no leadership action now.