/
← Voltar ao feed
medium

Unit 42 research: root on a Kubernetes node enables SPIFFE/SPIRE workload identity spoofing via cgroup manipulation (Spooffe tool)

1 fonte(s) · 1 atualização(ões) · publicado 10/09/2026 07:00 · coletado há 2 dias

Unit 42 published research showing that an attacker with root access on a compromised Kubernetes node can misuse SPIFFE/SPIRE workload attestation to impersonate co-located workloads and harvest their SVIDs. The attacker spoofs the Linux cgroup information the SPIRE agent uses to identify callers, so the agent issues a victim workload's identity to an attacker-controlled process. Unit 42 has not observed this technique exploited in the wild. The team released Spooffe, an open-source tool that lets defenders test exposure by automating identity extraction from a node. The core finding is that machine-identity systems assume the node is trusted, and that assumption collapses once the node is rooted.

Detalhes técnicos

  • The SPIRE agent receives the caller PID over the Workload API (Unix socket, e.g. /run/spire/sockets/agent.sock). The k8s workload attestor reads /proc/<pid>/mountinfo or /proc/<pid>/cgroups to extract the pod UID and container ID. It then queries the kubelet and builds selectors, which are combined with Unix attestor selectors (UID/GID) and matched against cached registration entries.
  • With root, the attacker copies the victim workload's cgroup path to a mock cgroup and writes their own shell PID into its cgroup.procs. Writing directly into the original cgroup would also work. The agent then returns the victim's SVID (X.509 or JWT) to the attacker process. The researchers confirmed the victim's SPIFFE ID inside the JWT.
  • Spooffe scans the node for workloads, replicates their cgroup paths for its own process, and queries the local SPIRE agent to collect all SVIDs on the host. It also includes an agent-impersonation capability that tests whether an attacker can talk directly to the SPIRE server as the agent.
  • Impact: lateral movement using legitimate credentials rather than stolen secrets, and access to any service that trusts the impersonated identity.

Remediação

  • Threat-model root on a node as compromise of all identities scoped to that node.
  • Prohibit privileged containers and restrict direct host access.
  • Minimize reliance on weak or easily spoofable selectors.
  • Use Spooffe to test exposure in your own environment.
  • Palo Alto Networks points to Cortex Cloud Identity Threat Detection and Cortex XDR/XSIAM for detection.

Linha do tempo

  1. unit42.paloaltonetworks.com ↗ · pub. 10/09/2026 07:00 · coletado 19/10 17:56 primeiro registro

    Unit 42 research: root on a Kubernetes node enables SPIFFE/SPIRE workload identity spoofing via cgroup manipulation (Spooffe tool)

    ler a análise desta fonte

    Unit 42 published research showing that an attacker with root access on a compromised Kubernetes node can misuse SPIFFE/SPIRE workload attestation to impersonate co-located workloads and harvest their SVIDs. The attacker spoofs the Linux cgroup information the SPIRE agent uses to identify callers, so the agent issues a victim workload's identity to an attacker-controlled process. Unit 42 has not observed this technique exploited in the wild. The team released Spooffe, an open-source tool that lets defenders test exposure by automating identity extraction from a node. The core finding is that machine-identity systems assume the node is trusted, and that assumption collapses once the node is rooted.

    Technical Details

    • The SPIRE agent receives the caller PID over the Workload API (Unix socket, e.g. /run/spire/sockets/agent.sock). The k8s workload attestor reads /proc/<pid>/mountinfo or /proc/<pid>/cgroups to extract the pod UID and container ID. It then queries the kubelet and builds selectors, which are combined with Unix attestor selectors (UID/GID) and matched against cached registration entries.
    • With root, the attacker copies the victim workload's cgroup path to a mock cgroup and writes their own shell PID into its cgroup.procs. Writing directly into the original cgroup would also work. The agent then returns the victim's SVID (X.509 or JWT) to the attacker process. The researchers confirmed the victim's SPIFFE ID inside the JWT.
    • Spooffe scans the node for workloads, replicates their cgroup paths for its own process, and queries the local SPIRE agent to collect all SVIDs on the host. It also includes an agent-impersonation capability that tests whether an attacker can talk directly to the SPIRE server as the agent.
    • Impact: lateral movement using legitimate credentials rather than stolen secrets, and access to any service that trusts the impersonated identity.

    Remediation

    • Threat-model root on a node as compromise of all identities scoped to that node.
    • Prohibit privileged containers and restrict direct host access.
    • Minimize reliance on weak or easily spoofable selectors.
    • Use Spooffe to test exposure in your own environment.
    • Palo Alto Networks points to Cortex Cloud Identity Threat Detection and Cortex XDR/XSIAM for detection.