CVE-2025-0426

What it actually does

Unauthenticated requests to the kubelet read-only HTTP endpoint can trigger repeated container checkpoint operations that consume disk space until the node becomes unavailable.

Why it matters to the business

Workloads on affected nodes may stop running, causing service outages and requiring manual intervention to restore capacity.

How an attack unfolds

An attacker discovers an exposed kubelet read-only port and issues a high volume of checkpoint requests for containers; each request writes checkpoint data to disk, eventually exhausting storage and triggering a node-level denial of service.

How to fix it

Disable the kubelet read-only port or restrict it to localhost only; ensure any future Kubernetes updates that address checkpoint handling are applied promptly.

How to confirm the fix worked

Inspect kubelet configuration for the --read-only-port flag or equivalent; attempt a single checkpoint request from a non-localhost address to confirm the endpoint is no longer reachable.

Typical attack path

1. Scan for publicly reachable kubelet read-only ports (typically 10255)
2. Send repeated unauthenticated checkpoint requests for multiple containers
3. Monitor disk utilization until the node reports storage pressure or becomes unresponsive

How to detect it

Search kubelet and container runtime logs for repeated checkpoint request entries; correlate with rapid increases in disk usage under checkpoint directories and node eviction or NotReady events.

• checkpoint request
• kubelet.*checkpoint
• /var/lib/kubelet/checkpoints

What your security team should do

• Immediately disable or firewall the kubelet read-only endpoint across all clusters
• Add network policies or host firewall rules to block external access to port 10255
• Monitor node disk usage for sudden spikes correlated with checkpoint activity
• Review and apply any subsequent Kubernetes releases that harden checkpoint behavior