get nodes/log
Kubelet logs routinely carry credentials, tokens and connection strings, and this reads them without exec.
The subresource only gates a direct connection to the kubelet on port 10250, where the kubelet authorizes the caller.
Through the API server proxy the check is nodes/proxy, which already subsumes log access.
On vulnerable Windows nodes, CVE-2024-9042 turned node log queries into command injection.
Note:
CVE-2024-9042 affected Windows nodes using NodeLogQuery and is patched.
Kubelet fine-grained authorization maps /logs/* to nodes/log, but the kubelet evaluates that against whoever connects to it, which is the API server when proxying, so granting a user nodes/log alone does not open /proxy/logs.
- API Group
- (core)
- Scope
- cluster
- Audit Level
- Request
Escalation Paths
Read kubelet-managed logs for pods and system components on a node.
Through the API server proxy this is gated by nodes/proxy.
nodes/log applies to a direct kubelet connection on port 10250
Applications commonly log credentials, tokens, connection strings, and startup configuration.
Harvest high-value secrets without exec access.
On vulnerable Windows nodes with NodeLogQuery, CVE-2024-9042 made this a command-injection path.
Additional rights needed:
Note:
nodes/log is a real kubelet authorization subresource, but the kubelet checks it against the identity connecting to it, so via the API server proxy nodes/proxy is the effective gate.
CVE-2024-9042 was Windows-specific and is patched.