Kubetier
T0nodes/proxy WebSocket exec bypass

  1. Connect to the exec endpoint via WebSocket.

    The HTTP GET upgrade handshake maps to the 'get' verb at the kubelet, so get nodes/proxy alone is sufficient

  2. The kubelet never performs a secondary 'create' check for the exec operation that follows the handshake

  3. Path A, via API server proxy, uses curl with Upgrade: websocket headers.

    Auth is logged as a nodes/proxy check only, the actual exec is invisible to audit

  4. Path B is direct to the kubelet on port 10250, using websocat wss://$NODE_IP:10250/exec/....

    Zero API server audit events are generated

  5. Execute arbitrary commands in any pod on the node, and steal service account tokens to pivot

Note:

There is no CVE.

The security team calls this working as intended (Jan 2026).

CVE-2020-8559 and CVE-2022-3294 are separate patched issues.

WebSocket exec bypass has no fix.

KEP-2862 adds narrower subresources but does not cover exec/attach/portforward.

K8s docs ↗