create apiservices
Registering an APIService for an API group makes the aggregation layer proxy all requests for that group to your backend, with trusted X-Remote-User and X-Remote-Group headers attached.
Caller bearer tokens and TLS certificates are not forwarded, so you can spoof or intercept traffic for the claimed group.
- API Group
- apiregistration.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Create an APIService for an API group pointing at an attacker-controlled backend
Requests for that group are proxied with trusted X-Remote-User and X-Remote-Group identity headers.
Caller bearer tokens and TLS certificates are NOT forwarded to the backend
Observe or spoof responses for the claimed API group.
This gives data interception within that group, not a generic credential-theft primitive
Additional rights needed:
Note:
CVE-2018-1002105 and CVE-2022-3172 are patched in all current versions.
The aggregated-APIService MITM path (X-Remote-User/Group headers forwarded to backend with caller identity) is a design property, not a CVE, and remains in all versions where aggregation is enabled.