Loading story…
Unit 42 demonstrated that an attacker with root access to a Kubernetes node running SPIFFE/SPIRE can falsify Linux cgroup metadata during workload attestation and obtain SVIDs for other workloads co-located on that node. The attacker can then impersonate those workloads with valid, short-lived cryptographic identities, enabling access to services and potential lateral movement without stealing long-lived credentials.
The technique relies on SPIRE's trust in node and kernel-provided process metadata and is not exploitable without node-level compromise; Unit 42 reported no observed in-the-wild exploitation. The researchers released the open-source Spooffe assessment tool for enumerating identities exposed through selector spoofing, and recommend treating root compromise of a SPIRE-enabled node as compromise of every workload identity on it, restricting root and host access, prohibiting privileged containers, and avoiding weak or easily spoofed selectors.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
Unit 42 released Spooffe, an open-source defensive tool that enumerates workloads on a SPIRE-enabled node, spoofs matching cgroup paths, and queries the local SPIRE Agent for resulting workload identities. The tool also assesses potential SPIRE Agent impersonation against the SPIRE Server.
Unit 42 disclosed research showing that an attacker with root access to a Kubernetes node can spoof cgroup metadata during SPIRE workload attestation and obtain SVIDs for co-located workloads. The researchers stated they had not observed the technique exploited in the wild.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
unit42.paloaltonetworks.com
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
TeamTNT abused an exposed Docker API to deploy a privileged Ubuntu container, mount the host filesystem, run cryptominers, and create a privileged SSH user. The group installed the legitimate **Weave Scope** Docker/Kubernetes administration tool, exposing its web dashboard on default port `4040` to map container environments and execute commands—effectively obtaining backdoor-like control through trusted software rather than custom malware. A compromised container can also become a path to cloud-account takeover through instance metadata services, pod IAM/AAD identities, embedded long-term cloud keys, and container escapes. Organizations should restrict Docker APIs and Weave Scope access, prevent pod access to metadata endpoints, enforce least-privilege workload identities and Kubernetes RBAC, eliminate long-term credentials from pods and secrets, remediate vulnerable workloads, and segment networks to limit lateral movement.
Sep 3, 2026
Two newly disclosed Kubernetes vulnerabilities show how limited access can escalate into broad secret theft and potential full-cluster compromise. **CVE-2026-39961** affects the Aiven Operator and enables cross-namespace secret exfiltration through a confused deputy condition, breaking multi-tenancy and namespace isolation. An attacker starting from a constrained developer role could access high-value service account tokens, particularly in `kube-system`, and potentially obtain `cluster-admin` privileges. From there, they could deploy malicious DaemonSets, alter node settings, read cluster-wide data, and pivot into cloud environments through permissive IAM integrations such as AWS IAM Roles for Service Accounts.
Jun 29, 2026
Public proof-of-concept exploit code was released for **DirtyDecrypt** (`CVE-2026-31635`), a high-severity Linux kernel local privilege escalation flaw caused by a missing copy-on-write guard in `rxgk_decrypt_skb()` within the RxGK subsystem. The bug allows unprivileged local users to corrupt shared page-cache memory tied to privileged files or processes, potentially overwriting targets such as `/etc/shadow`, `/etc/sudoers`, or SUID binaries to gain **root**. Reports said the issue was quietly patched upstream in late April and primarily affects systems using mainline or rolling-release kernels with `CONFIG_RXGK` enabled, including **Fedora**, **Arch Linux**, and **openSUSE Tumbleweed**; the risk is elevated on Kubernetes worker nodes and developer workstations because exploitation can also enable container escape and theft of secrets or runtime sockets. At the same time, researchers disclosed **PinTheft**, another Linux local privilege escalation exploit that abuses a double-free or refcount bug in the **RDS zerocopy send path** and uses `io_uring` fixed buffers to turn the flaw into a page-cache overwrite against a SUID-root binary. The exploit, credited to Aaron Esau of V12 Security, reportedly drains page references through failed RDS zerocopy sends, frees the page, reclaims it as page cache, and overwrites it with a malicious ELF payload that yields a root shell when executed. Mailing list discussion said a patch and proof of concept are available, with exploitability depending on the `rds` kernel module being present or autoloadable; **Arch Linux** was reported to enable it by default, while Fedora may also be exposed and Debian and Ubuntu appear to have mitigations that restrict autoloading.
Jun 29, 2026