create nodes
This is where Fake-Node SSRF starts.
A Node whose status.addresses points at the API server IP, with daemonEndpoints.kubeletEndpoint.Port set to 6443, makes the API server proxy to itself using its apiserver-kubelet-client certificate.
It is inert without get on nodes/proxy to trigger the proxy call.
A Node registered with a DNS name rather than an IP is also the vector for the proxy DNS-rebinding bypass (CVE-2020-8562).
T0 with following verbs:
Full cluster access through a self-authenticated request to the kubelet API
Registering a Node object is inert on its own.
Reached through nodes/proxy it returns cluster-admin only where the apiserver-kubelet-client certificate still maps to a privileged group: kubeadm before 1.33.12, 1.34.8, 1.35.5 or 1.36.1, every 1.32 and earlier release, and any distribution binding that certificate to system:masters.
Note:
kubeadm 1.33.12, 1.34.8, 1.35.5 and 1.36.1 drop the Organization from the apiserver-kubelet-client certificate and bind its CommonName to system:kubelet-api-admin, so self-authentication returns node API access, not cluster-admin.
Upgrades renew that certificate by default; where renewal is off or the PKI is managed outside kubeadm, the old mapping persists.
1.32 is end of life.
- API Group
- (core)
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Register a fake Node object with status.addresses[InternalIP] = API server internal IP and daemonEndpoints.kubeletEndpoint.Port = 6443
Proxy a request through the fake node by running kubectl get --raw /api/v1/nodes/evil-node/proxy/api/v1/secrets
The API server proxies outbound to that address using its apiserver-kubelet-client certificate, so it authenticates to itself
Before kubeadm 1.29 the certificate carried O=system:masters.
From 1.29 it carried O=kubeadm:cluster-admins, a group bound to cluster-admin, so the inner request still returned full cluster access
Current kubeadm binds the certificate to system:kubelet-api-admin instead, narrowing the inner request to the node API (nodes/proxy, metrics, stats, log) rather than cluster-admin
The redirection itself is unchanged by that fix, so the API server can still be pointed at an attacker-chosen address
Post-fix, the gain is network position rather than RBAC, since triggering it already requires get on nodes/proxy.
The API server reaches addresses the caller cannot, under its own identity
Additional rights needed:
· both; the Node object is inert until proxied to
Note:
Those releases narrow the certificate to system:kubelet-api-admin, which removes the cluster-admin outcome but not the redirection.
kubernetes#119270 is still open, reopened for audit re-evaluation.
1.32 reached end of life first, so it stays vulnerable.
No CVE covers this path.
Register a fake Node with a DNS rebinding hostname that initially resolves to a valid public IP
API server checks isProxyableHost before connecting.
At check time, DNS resolves to the allowed IP
By connect time, DNS flips to 127.0.0.1 or 169.254.x.x.
The blocklist check is not re-run (TOCTOU)
SSRF reaches loopback services such as kube-proxy :10249 configz, etcd :2379, and control-plane localhost ports
Additional rights needed:
· both; registering the address and proxying to it
Note:
This is a wontFix.
Fixing requires IP pinning between check and connect, which breaks split-horizon DNS.
Mitigation is dnsmasq min-cache-ttl.