Unit 42 research: root on a Kubernetes node enables SPIFFE/SPIRE workload identity spoofing via cgroup manipulation (Spooffe tool)
Unit 42 published research showing that an attacker with root access on a compromised Kubernetes node can misuse SPIFFE/SPIRE workload attestation to impersonate co-located workloads and harvest their SVIDs. The attacker spoofs the Linux cgroup information the SPIRE agent uses to identify callers, so the agent issues a victim workload's i…