Read kubelet-managed logs for pods and system components on a node.
Through the API server proxy this is gated by nodes/proxy.
nodes/log applies to a direct kubelet connection on port 10250
Applications commonly log credentials, tokens, connection strings, and startup configuration.
Harvest high-value secrets without exec access.
On vulnerable Windows nodes with NodeLogQuery, CVE-2024-9042 made this a command-injection path.
Note:
nodes/log is a real kubelet authorization subresource, but the kubelet checks it against the identity connecting to it, so via the API server proxy nodes/proxy is the effective gate.
CVE-2024-9042 was Windows-specific and is patched.