Create or modify Endpoints or EndpointSlices so a Service resolves to addresses it was never meant to reach, such as node-local services or an attacker-controlled host.
kube-proxy programs those addresses and every client of that Service follows them.
Callers keep using the Service name they trust, which is what makes the Service the confused deputy.
End-to-end delivery depends on the CNI and kube-proxy mode in use, so the reachable destination set varies by cluster.
Rights needed, any one set:
· any one; the mirroring controller links the two
· any one; the mirroring controller links the two
Note:
CVE-2021-25740 is best treated as a confused-deputy risk from write access to Endpoints/EndpointSlices, not a clean version-gated issue.
Kubernetes removed broad Endpoint/EndpointSlice write from default admin/edit roles in v1.22+, but explicit grants remain dangerous.