Root Access on Kubernetes Nodes Enables Theft of SPIFFE Identities and Application Spoofing

Security researchers have uncovered a post‑exploitation method that allows an adversary with root privileges on a Kubernetes node to hijack workload identities generated by the SPIFFE/SPIRE framework, effectively masquerading as legitimate services running on the same host.

The flaw exploits the trust model that assumes a node’s operating system cannot be compromised. By gaining root access—through a misconfiguration, vulnerable container image, or a separate breach—an attacker can read the SPIFFE workload certificates stored on the node, extract the private keys, and then present those credentials to other services in the cluster as if they were the original application.

SPIFFE (Secure Production Identity Framework for Everyone) and its implementation SPIR​E are widely adopted for providing cryptographic identities to microservices, enabling mutual TLS and fine‑grained authorization without relying on traditional secrets. The newly disclosed technique subverts this model by allowing the stolen identities to be reused, thereby bypassing the intended isolation between workloads.

While the vulnerability does not stem from a flaw in SPIFFE itself, it highlights a broader risk: the “node‑trust” assumption that underpins many Kubernetes security policies. If a node is compromised, the attacker can potentially impersonate any workload on that node, gaining access to data, APIs, or downstream services that trust the stolen certificates.

Experts recommend mitigating the risk by hardening node security, employing runtime defenses such as eBPF‑based monitoring, and limiting the exposure of credential stores. Additionally, rotating SPIFFE certificates frequently and using hardware‑based key storage where possible can reduce the window of opportunity for attackers. The findings were initially reported by the security group GBHackers, prompting cloud providers and Kubernetes users to reassess their node‑level defenses.