Kubernetes Node Compromise Exposes SPIFFE/SPIRE Workload Identities in New Attack Technique Researchers at Palo Alto Networks’ Unit 42 have uncovered a post-exploitation technique that allows attackers with root-level access to a Kubernetes node to steal and impersonate workload identities issued via SPIFFE/SPIRE, undermining the security of cloud-native identity systems. The attack exploits a critical flaw in the node-trust assumption underlying SPIFFE (Secure Production Identity Framework for Everyone) and its reference implementation, SPIRE. These systems replace static credentials with short-lived, cryptographically verifiable workload identities SPIFFE IDs and SPIFFE Verifiable Identity Documents (SVIDs) used for mutual TLS (mTLS) authentication and identity-based authorization. While effective when the host remains secure, Unit 42’s findings demonstrate that node-level compromise collapses this security boundary. ### How the Attack Works The technique targets SPIRE workload attestation, the process by which a SPIRE agent verifies a local process’s eligibility to receive a workload identity. In Kubernetes environments, the agent relies on Linux `/proc` data and cgroup paths to extract workload attributes such as namespace, service account, pod UID, and container image before issuing an SVID. An attacker with root privileges can manipulate cgroup metadata to make a malicious process appear as a legitimate co-located container. By spoofing these attributes, the attacker tricks the SPIRE agent into issuing a valid SVID for the impersonated workload. The stolen credentials whether X.509 certificates for mTLS or JWTs for API authorization can then be used to authenticate as the victim application, enabling lateral movement and privilege escalation within the cluster. ### Impact and Risks The attack does not break SPIFFE’s cryptographic protections but instead exploits the trust placed in the node itself. Once a Kubernetes worker is compromised, all workload identities scoped to that node must be considered exposed. Stolen SVIDs could grant attackers access to: - Internal services protected by mTLS - Identity-aware APIs and authorization layers - High-privilege workloads within the cluster Unit 42 has not observed this technique in active attacks but warns that organizations using SPIFFE/SPIRE should treat root access to a node as equivalent to a full identity breach. ### Defensive Measures and Tools To help security teams assess exposure, Unit 42 released Spooffe, an open-source tool designed to simulate the attack. Spooffe scans a node for running workloads, identifies their cgroup paths, and tests whether an attacker could spoof selectors to harvest SVIDs. The tool is intended for authorized defensive validation, allowing teams to measure the potential blast radius of a node compromise. The research underscores the need for hardened node security, including: - Restricting root and privileged-container access - Preventing unnecessary host namespaces, sockets, and filesystem mounts - Minimizing reliance on weak or overly broad workload selectors - Reviewing high-value identities issued per node While SPIFFE/SPIRE remains a robust identity framework, this attack highlights that workload identity security is only as strong as the node’s defenses.