Communication Dans Un Congrès Année : 2025

Inside Job: Defending Kubernetes Clusters Against Network Misconfigurations

Résumé

Kubernetes has emerged as the de facto standard for container orchestration. Unfortunately, its increasing popularity has also made it an attractive target for malicious actors. Despite extensive research on securing Kubernetes, little attention has been paid to the impact of network configuration on the security of application deployments. This paper addresses this gap by conducting a comprehensive analysis of network misconfigurations in a Kubernetes cluster with specific reference to lateral movement. Accordingly, we carried out an extensive evaluation of 287 open-source applications belonging to six different organizations, ranging from IT companies and public entities to non-profits. As a result, we identified 634 misconfigurations, well beyond what could be found by solutions in the state of the art. We responsibly disclosed our findings to the concerned organizations and engaged in a discussion to assess their severity. As of now, misconfigurations affecting more than thirty applications have been fixed with the mitigations we proposed.

Fichier principal
Vignette du fichier
3749220.pdf (1.43 Mo) Télécharger le fichier
Origine Fichiers éditeurs autorisés sur une archive ouverte
Licence

Dates et versions

hal-05230013 , version 1 (29-08-2025)

Licence

Identifiants

Citer

Jacopo Bufalino, Jose Luis Martin Navarro, Mario Di Francesco, Tuomas Aura. Inside Job: Defending Kubernetes Clusters Against Network Misconfigurations. CoNEXT, Dec 2025, Hong Kong, France. ⟨10.1145/3749220⟩. ⟨hal-05230013⟩
580 Consultations
514 Téléchargements

Altmetric

Partager

  • More