{"id":46855,"date":"2022-05-27T20:54:18","date_gmt":"2022-05-27T20:54:18","guid":{"rendered":"https:\/\/www.darkreading.com\/dr-tech\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks"},"modified":"2022-05-27T20:54:18","modified_gmt":"2022-05-27T20:54:18","slug":"exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/","title":{"rendered":"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks"},"content":{"rendered":"<div><img decoding=\"async\" src=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt912ef54211feb16c\/62913a31310f0577232432c9\/kubernetes-LuckyStep-AdobeStock.png\" class=\"ff-og-image-inserted\"><\/div>\n<p>Kubernetes clusters provide a scalable and resilient backbone to many modern Internet-facing applications. However, if adversaries can access the nodes in those clusters, they essentially take over your infrastructure. They can compromise the integrity of your systems and hijack the infrastructure and use it for their own purposes.<\/p>\n<p>Recent data from Shodan shows 243,469 <a href=\"https:\/\/www.darkreading.com\/application-security\/more-than-eight-in-10-kubernetes-api-servers-exposed-to-the-internet\" target=\"_blank\" rel=\"noopener\">Kubernetes clusters that are publicly exposed<\/a>. These clusters also exposed port 10250, used by the kubelet (the agent that runs on each node and ensures that all containers are running in a pod) as a default setting. Attackers could potentially use the kubelet API as an entry point in targeting Kubernetes clusters to mine for cryptocurrency.<\/p>\n<p><a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/22\/e\/the-fault-in-our-kubelets-analyzing-the-security-of-publicly-exposed-kubernetes-clusters.html\" target=\"_blank\" rel=\"noopener\">Trend Micro researcher Magno Logan<\/a> looked at how cybercriminals could abuse these clusters and exposed kubelet ports.<\/p>\n<p>First, there is the problem of sensitive information leakage by returning data on the running pods on the node.<\/p>\n<p>In addition, since the kubelet API is exposed, there is another endpoint <em>\/run<\/em> that would allow an attacker to execute commands inside the running pods of the cluster just by sending a <em>POST<\/em> request to the specific pods and using the parameter <em>cmd<\/em> to execute the desired shell commands. Trend Micro says <a href=\"https:\/\/www.trendmicro.com\/en_us\/research\/21\/e\/teamtnt-targets-kubernetes--nearly-50-000-ips-compromised.html\" target=\"_blank\" rel=\"noopener\">threat actor TeamTNT<\/a> performed multiple <em>\/run<\/em> commands in just this manner to compromise multiple clusters last year. This technique can make things easier for attackers to take over clusters, Logan says in the report.<\/p>\n<p>Logan called it &#8220;very concerning&#8221; that hackers could use the kubelet API as an entry point when targeting Kubernetes clusters.<\/p>\n<p>&#8220;Those 600 kubelets we&#8217;ve found to be completely exposed and without authentication or authorization could easily be compromised via simple API requests,&#8221; he said. &#8220;That would allow an attacker to execute commands on the pods running inside that node, most of the time to mine cryptocurrencies.&#8221;<\/p>\n<h2 class=\"regular-text\">Exposed Kubelets Leave Door Open to Malicious Actors<\/h2>\n<p>According to Michael Isbitski, director of cybersecurity strategy for Sysdig, when Kubernetes clusters or kubelets are improperly exposed or don&#8217;t enforce proper access control, it leaves the door open for a wide range of malicious activity.<\/p>\n<p>&#8220;Attackers can potentially harvest sensitive data being transmitted within the cluster, spin-up new workloads, reconfigure elements of a node, disable access controls, erase audit trails, add vulnerable dependencies, bootstrap malicious cryptominers, and more,&#8221; he says.<\/p>\n<p>Isbitski notes that many Kubernetes configurations are secure by default with current platform offerings, but some organizations may be sitting on old or misconfigured deployments.<\/p>\n<p>He points out organizations also sometimes inadvertently override secure defaults to get a cluster to an operational state without understanding the potential security risks.<\/p>\n<p>&#8220;We&#8217;ve seen issues with vulnerabilities in runtime components, which can result in container escapes and lateral movement within networks if attackers are successful in their exploitation attempts,&#8221; he says.<\/p>\n<h2 class=\"regular-text\">Practice Defense In-Depth, Zero Trust<\/h2>\n<p>Matt Dupre, director of software engineering at Tigera, a provider of security and observability for containers, Kubernetes, and cloud, points out that sufficiently privileged access to the kubelet amounts to a complete compromise of that host and potentially any other workloads running on it.<\/p>\n<p>Access to the Kubernetes API has the same potential impact: Admin access essentially provides complete control of the cluster and everything in it.<\/p>\n<p>He notes that while the security risk is significant, an overwhelming majority of the clusters that accepted connections from the Internet rejected the requests due to lack of authentication or authorization.<\/p>\n<p>&#8220;Given that, there are two concerns: firstly, that you fall in that misconfigured 613 clusters, or that a new critical vulnerability that bypasses authn or authz is found, and this would be a very significant vulnerability,&#8221; Dupre says. &#8220;Organizations&#8217; internal APIs are probably a bigger worry in practice.&#8221;<\/p>\n<p>He advises practicing defense in depth by following zero-trust principles and not allowing connections to your kubelets from unknown sources, such as the Internet.<\/p>\n<p>&#8220;Additionally, you could port-scan your infrastructure and investigate any responses,&#8221; he adds. &#8220;Keeping careful control of access tokens is always important \u2014 they should never be published, and you should have processes in place to ensure that they and other secrets are stored properly.&#8221;<\/p>\n<h2 class=\"regular-text\">Avoid Exposing the Kubelet Default Port<\/h2>\n<p>As a basic kubelet security practice, Logan says organizations shouldn\u2019t expose their kubelet port (10250 by default) to the Internet.<\/p>\n<p>&#8220;If you need to do that, at least enable kubelet authentication and authorization on the kubelet API to avoid attackers being able to perform requests to the API and receive the 401 \u2013 Unauthorized response,&#8221; he adds.<\/p>\n<p>Mark Lambert, vice president of products at ArmorCode, an application security provider, says when deploying these types of systems, take a &#8220;zero-trust mindset&#8221; and remember that the default configurations are usually set up for ease of use, not security.<\/p>\n<p>&#8220;This means you need to pay close attention to configuration files, disable features you are not using, change default ports, and minimize information leakage so that hackers cannot gain insight that could provide them another point of attack,&#8221; he says.<\/p>\n<p>Finally, all this needs to be operationalized as part of your application security program, and development teams must be engaged early, as they play a key role in building security into the design of the application from the start.<\/p>\n<p>Besides enabling the kubelet authentication and authorization on the kubelet API, Logan advises restricting the kubelet permissions via the least privilege principle and periodically rotating the kubelet certificates to reduce the attack surface.<\/p>\n<p>&#8220;Organizations should also investigate tools for runtime protection such as Falco to prevent and alert when there are suspicious execution happening inside their containers,&#8221; he says.<\/p>\n<h2 class=\"regular-text\">Constantly Analyze IaaC, Monitor Clusters in Runtime<\/h2>\n<p>Isbitski says native capabilities and tooling from cloud providers and Kubernetes platform providers can provide a starting point for keeping kubelets protected.<\/p>\n<p>He adds that security teams must continuously analyze the infrastructure-as-code used to configure and operate clusters, scan dependencies used by workloads, and monitor clusters in runtime to detect malicious activity, such as when an attacker attempts unauthorized access to the Kubernetes APIs.<\/p>\n<p>&#8220;Appropriate access control should also be implemented at multiple points of a cluster,&#8221; he says. &#8220;Native capabilities like Kubernetes network policy also help with restricting communication within a cluster and enforce zero trust principles.&#8221;<\/p>\n<p>Isbitski points out the Kubernetes control plane is also multilayered when working with managed Kubernetes.<\/p>\n<p>In those scenarios, security teams should also continuously validate the cloud tenant configurations, along with IAM policies, for misconfigurations and excessive permissions.<\/p>\n<p>Read More <a href=\"https:\/\/www.darkreading.com\/dr-tech\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\">HERE<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Organizations must ensure their kubelets and related APIs aren\u2019t inadvertently exposed or lack proper access control, offering an easy access point for malicious actors.Read More <a href=\"https:\/\/www.darkreading.com\/dr-tech\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\">HERE<\/a><\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"colormag_page_layout":"default_layout","footnotes":""},"categories":[151],"tags":[],"class_list":["post-46855","post","type-post","status-publish","format-standard","hentry","category-darkreading-ti"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v28.1 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks 2026 | ThreatsHub Cybersecurity News<\/title>\n<meta name=\"description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks 2026 | ThreatsHub Cybersecurity News\" \/>\n<meta property=\"og:description\" content=\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security &amp; Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/\" \/>\n<meta property=\"og:site_name\" content=\"ThreatsHub Cybersecurity News\" \/>\n<meta property=\"article:published_time\" content=\"2022-05-27T20:54:18+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt912ef54211feb16c\/62913a31310f0577232432c9\/kubernetes-LuckyStep-AdobeStock.png\" \/>\n<meta name=\"author\" content=\"TH Author\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@threatshub\" \/>\n<meta name=\"twitter:site\" content=\"@threatshub\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"TH Author\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"5 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/\"},\"author\":{\"name\":\"TH Author\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\"},\"headline\":\"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks\",\"datePublished\":\"2022-05-27T20:54:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/\"},\"wordCount\":1065,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt912ef54211feb16c\\\/62913a31310f0577232432c9\\\/kubernetes-LuckyStep-AdobeStock.png\",\"articleSection\":[\"DarkReading |TI\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/\",\"name\":\"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks 2026 | ThreatsHub Cybersecurity News\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt912ef54211feb16c\\\/62913a31310f0577232432c9\\\/kubernetes-LuckyStep-AdobeStock.png\",\"datePublished\":\"2022-05-27T20:54:18+00:00\",\"description\":\"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/#primaryimage\",\"url\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt912ef54211feb16c\\\/62913a31310f0577232432c9\\\/kubernetes-LuckyStep-AdobeStock.png\",\"contentUrl\":\"https:\\\/\\\/eu-images.contentstack.com\\\/v3\\\/assets\\\/blt66983808af36a8ef\\\/blt912ef54211feb16c\\\/62913a31310f0577232432c9\\\/kubernetes-LuckyStep-AdobeStock.png\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#website\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"name\":\"ThreatsHub Cybersecurity News\",\"description\":\"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\"},\"alternateName\":\"Threatshub.org\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#organization\",\"name\":\"ThreatsHub.org\",\"alternateName\":\"Threatshub.org\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"contentUrl\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/Threatshub_Favicon1.jpg\",\"width\":432,\"height\":435,\"caption\":\"ThreatsHub.org\"},\"image\":{\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/x.com\\\/threatshub\"]},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.threatshub.org\\\/blog\\\/#\\\/schema\\\/person\\\/12e0a8671ff89a863584f193e7062476\",\"name\":\"TH Author\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g\",\"caption\":\"TH Author\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks 2026 | ThreatsHub Cybersecurity News","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/","og_locale":"en_US","og_type":"article","og_title":"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks 2026 | ThreatsHub Cybersecurity News","og_description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","og_url":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/","og_site_name":"ThreatsHub Cybersecurity News","article_published_time":"2022-05-27T20:54:18+00:00","og_image":[{"url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt912ef54211feb16c\/62913a31310f0577232432c9\/kubernetes-LuckyStep-AdobeStock.png","type":"","width":"","height":""}],"author":"TH Author","twitter_card":"summary_large_image","twitter_creator":"@threatshub","twitter_site":"@threatshub","twitter_misc":{"Written by":"TH Author","Est. reading time":"5 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/#article","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/"},"author":{"name":"TH Author","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476"},"headline":"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks","datePublished":"2022-05-27T20:54:18+00:00","mainEntityOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/"},"wordCount":1065,"commentCount":0,"publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt912ef54211feb16c\/62913a31310f0577232432c9\/kubernetes-LuckyStep-AdobeStock.png","articleSection":["DarkReading |TI"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/","url":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/","name":"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks 2026 | ThreatsHub Cybersecurity News","isPartOf":{"@id":"https:\/\/www.threatshub.org\/blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/#primaryimage"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/#primaryimage"},"thumbnailUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt912ef54211feb16c\/62913a31310f0577232432c9\/kubernetes-LuckyStep-AdobeStock.png","datePublished":"2022-05-27T20:54:18+00:00","description":"ThreatsHub Cybersecurity News | ThreatsHub.org | Cloud Security & Cyber Threats Analysis Hub. 100% Free OSINT Threat Intelligent and Cybersecurity News.","breadcrumb":{"@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/#primaryimage","url":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt912ef54211feb16c\/62913a31310f0577232432c9\/kubernetes-LuckyStep-AdobeStock.png","contentUrl":"https:\/\/eu-images.contentstack.com\/v3\/assets\/blt66983808af36a8ef\/blt912ef54211feb16c\/62913a31310f0577232432c9\/kubernetes-LuckyStep-AdobeStock.png"},{"@type":"BreadcrumbList","@id":"https:\/\/www.threatshub.org\/blog\/exposed-kubernetes-clusters-kubelet-ports-can-be-abused-in-cyberattacks\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.threatshub.org\/blog\/"},{"@type":"ListItem","position":2,"name":"Exposed Kubernetes Clusters, Kubelet Ports Can Be Abused in Cyberattacks"}]},{"@type":"WebSite","@id":"https:\/\/www.threatshub.org\/blog\/#website","url":"https:\/\/www.threatshub.org\/blog\/","name":"ThreatsHub Cybersecurity News","description":"%%focuskw%% Threat Intel \u2013 Threat Intel Services \u2013 CyberIntelligence \u2013 Cyber Threat Intelligence - Threat Intelligence Feeds - Threat Intelligence Reports - CyberSecurity Report \u2013 Cyber Security PDF \u2013 Cybersecurity Trends - Cloud Sandbox \u2013- Threat IntelligencePortal \u2013 Incident Response \u2013 Threat Hunting \u2013 IOC - Yara - Security Operations Center \u2013 SecurityOperation Center \u2013 Security SOC \u2013 SOC Services - Advanced Threat - Threat Detection - TargetedAttack \u2013 APT \u2013 Anti-APT \u2013 Advanced Protection \u2013 Cyber Security Services \u2013 Cybersecurity Services -Threat Intelligence Platform","publisher":{"@id":"https:\/\/www.threatshub.org\/blog\/#organization"},"alternateName":"Threatshub.org","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.threatshub.org\/blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.threatshub.org\/blog\/#organization","name":"ThreatsHub.org","alternateName":"Threatshub.org","url":"https:\/\/www.threatshub.org\/blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","contentUrl":"https:\/\/www.threatshub.org\/blog\/coredata\/uploads\/2025\/05\/Threatshub_Favicon1.jpg","width":432,"height":435,"caption":"ThreatsHub.org"},"image":{"@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/x.com\/threatshub"]},{"@type":"Person","@id":"https:\/\/www.threatshub.org\/blog\/#\/schema\/person\/12e0a8671ff89a863584f193e7062476","name":"TH Author","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/066276f086d5155df79c850206a779ad368418a844da0182ce43f9cd5b506c3d?s=96&d=mm&r=g","caption":"TH Author"}}]}},"_links":{"self":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46855","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/comments?post=46855"}],"version-history":[{"count":0,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/posts\/46855\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/media?parent=46855"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/categories?post=46855"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.threatshub.org\/blog\/wp-json\/wp\/v2\/tags?post=46855"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}