Exposed Kubernetes API - RCE/Exposed Creds

Summary

@txt3rob found one of Snaps internal Kubernetes instances exposing an API endpoint without authorization to the public. With access to this API he was able to run arbitrary code/jobs as a cluster-admin and gained access to credentials with internal access to a significant number of instances.

During a worldwide kubernetes scan with binaryedge.io i found a K8 exposed internal API endpoint without authorization to the public.

With access to this API I was able to run arbitrary code/jobs as a cluster-admin and gained access to credentials with internal access to a significant number of instances.