create endpointslices
Writing EndpointSlices sets which IPs kube-proxy treats as Service backends.
In multi-tenant or loosely governed clusters this redirects Service traffic to cloud metadata, node-local services, or attacker-controlled endpoints.
Note:
CVE-2021-25740: architectural confused-deputy risk from Endpoint/EndpointSlice write access, not a version-gated fix.
Default admin/edit roles lost Endpoint/EndpointSlice write in v1.22+, but explicit grants remain dangerous regardless of cluster version.
- API Group
- discovery.k8s.io
- Scope
- namespaced
- Audit Level
- Request
Escalation Paths
Create or modify Endpoints or EndpointSlices so a Service resolves to addresses it was never meant to reach, such as node-local services or an attacker-controlled host.
kube-proxy programs those addresses and every client of that Service follows them.
Callers keep using the Service name they trust, which is what makes the Service the confused deputy.
End-to-end delivery depends on the CNI and kube-proxy mode in use, so the reachable destination set varies by cluster.
Additional rights needed:
Note:
CVE-2021-25740 is best treated as a confused-deputy risk from write access to Endpoints/EndpointSlices, not a clean version-gated issue.
Kubernetes removed broad Endpoint/EndpointSlice write from default admin/edit roles in v1.22+, but explicit grants remain dangerous.