Kubernetes Node Compromise Exposes SPIFFE/SPIRE Workload Identities in New Attack Technique
Researchers at Palo Alto Networks’ Unit 42 have uncovered a post-exploitation technique that allows attackers with root-level access to a Kubernetes node to steal and impersonate workload identities issued via SPIFFE/SPIRE, undermining the security of cloud-native identity systems.
The attack exploits a critical flaw in the node-trust assumption underlying SPIFFE (Secure Production Identity Framework for Everyone) and its reference implementation, SPIRE. These systems replace static credentials with short-lived, cryptographically verifiable workload identities SPIFFE IDs and SPIFFE Verifiable Identity Documents (SVIDs) used for mutual TLS (mTLS) authentication and identity-based authorization. While effective when the host remains secure, Unit 42’s findings demonstrate that node-level compromise collapses this security boundary.
How the Attack Works
The technique targets SPIRE workload attestation, the process by which a SPIRE agent verifies a local process’s eligibility to receive a workload identity. In Kubernetes environments, the agent relies on Linux /proc data and cgroup paths to extract workload attributes such as namespace, service account, pod UID, and container image before issuing an SVID.
An attacker with root privileges can manipulate cgroup metadata to make a malicious process appear as a legitimate co-located container. By spoofing these attributes, the attacker tricks the SPIRE agent into issuing a valid SVID for the impersonated workload. The stolen credentials whether X.509 certificates for mTLS or JWTs for API authorization can then be used to authenticate as the victim application, enabling lateral movement and privilege escalation within the cluster.
Impact and Risks
The attack does not break SPIFFE’s cryptographic protections but instead exploits the trust placed in the node itself. Once a Kubernetes worker is compromised, all workload identities scoped to that node must be considered exposed. Stolen SVIDs could grant attackers access to:
- Internal services protected by mTLS
- Identity-aware APIs and authorization layers
- High-privilege workloads within the cluster
Unit 42 has not observed this technique in active attacks but warns that organizations using SPIFFE/SPIRE should treat root access to a node as equivalent to a full identity breach.
Defensive Measures and Tools
To help security teams assess exposure, Unit 42 released Spooffe, an open-source tool designed to simulate the attack. Spooffe scans a node for running workloads, identifies their cgroup paths, and tests whether an attacker could spoof selectors to harvest SVIDs. The tool is intended for authorized defensive validation, allowing teams to measure the potential blast radius of a node compromise.
The research underscores the need for hardened node security, including:
- Restricting root and privileged-container access
- Preventing unnecessary host namespaces, sockets, and filesystem mounts
- Minimizing reliance on weak or overly broad workload selectors
- Reviewing high-value identities issued per node
While SPIFFE/SPIRE remains a robust identity framework, this attack highlights that workload identity security is only as strong as the node’s defenses.
Source: https://gbhackers.com/kubernetes-identity-attack/
SPIFFE TPRM report: https://www.rankiteo.com/company/spiffe-secure-production-identity-framework-for-everyone
SPIRE TPRM report: https://www.rankiteo.com/company/spireglobal
"id": "spispi1789648007",
"linkid": "spireglobal, spiffe-secure-production-identity-framework-for-everyone",
"type": "Vulnerability",
"date": "9/2026",
"severity": "85",
"impact": "4",
"explanation": "Attack with significant impact with customers data leaks"{'affected_entities': [{'industry': 'Cloud-native, DevOps, IT infrastructure',
'type': 'Organizations using Kubernetes with '
'SPIFFE/SPIRE'}],
'attack_vector': 'Node-level compromise (root access)',
'data_breach': {'data_encryption': 'SVIDs are cryptographically verifiable '
'but can be stolen if node is compromised',
'sensitivity_of_data': 'High (cryptographic credentials for '
'mTLS and API authorization)',
'type_of_data_compromised': 'Workload identities (SPIFFE IDs, '
'SVIDs)'},
'description': 'Researchers at Palo Alto Networks’ Unit 42 uncovered a '
'post-exploitation technique allowing attackers with '
'root-level access to a Kubernetes node to steal and '
'impersonate workload identities issued via SPIFFE/SPIRE, '
'undermining cloud-native identity systems. The attack '
'exploits a flaw in the node-trust assumption, enabling '
'attackers to manipulate cgroup metadata and trick SPIRE '
'agents into issuing valid SVIDs for impersonated workloads, '
'leading to lateral movement and privilege escalation.',
'impact': {'data_compromised': 'Workload identities (SPIFFE IDs, SVIDs - '
'X.509 certificates, JWTs)',
'identity_theft_risk': 'High (stolen workload identities enable '
'impersonation)',
'operational_impact': 'Lateral movement, privilege escalation, '
'unauthorized access to internal '
'services/APIs',
'systems_affected': 'Kubernetes clusters using SPIFFE/SPIRE for '
'workload identity'},
'investigation_status': 'Research and defensive validation (no active attacks '
'observed)',
'lessons_learned': 'Workload identity security is only as strong as the '
'node’s defenses. Node-level compromise collapses the '
'security boundary for SPIFFE/SPIRE identities, requiring '
'hardened node security and selective workload '
'attestation.',
'post_incident_analysis': {'corrective_actions': ['Implement node security '
'best practices (restrict '
'root access, limit host '
'mounts)',
'Use tools like Spooffe to '
'validate defenses',
'Review and refine workload '
'attestation policies'],
'root_causes': 'Node-trust assumption in '
'SPIFFE/SPIRE workload attestation; '
'lack of node-level security '
'hardening'},
'recommendations': ['Harden Kubernetes node security (restrict root access, '
'limit privileged containers)',
'Use Spooffe (open-source tool) to assess exposure and '
'simulate attacks',
'Minimize reliance on weak workload selectors in SPIRE',
'Review and limit high-value identities issued per node'],
'references': [{'source': 'Palo Alto Networks’ Unit 42'}],
'response': {'containment_measures': ['Restricting root and '
'privileged-container access',
'Preventing unnecessary host '
'namespaces, sockets, and filesystem '
'mounts',
'Minimizing reliance on weak or overly '
'broad workload selectors',
'Reviewing high-value identities issued '
'per node']},
'stakeholder_advisories': 'Organizations using SPIFFE/SPIRE should treat root '
'access to a node as equivalent to a full identity '
'breach.',
'title': 'Kubernetes Node Compromise Exposes SPIFFE/SPIRE Workload Identities '
'in New Attack Technique',
'type': 'Identity Compromise',
'vulnerability_exploited': 'Node-trust assumption in SPIFFE/SPIRE workload '
'attestation; manipulation of cgroup metadata'}