Once successfully impersonated, the attacker's process can request and receive SVIDs (X.509 or JWT) that are authorized for the target workload. This allows the attacker to assume the identity of the target within the trust domain, enabling unauthorized access to services, databases, or APIs that rely on workload-to-workload mTLS or token-based authentication. While the researchers released the 'Spooffe' tool to demonstrate this vector, there is currently no evidence of this technique being used in the wild. Defenders must treat root access to a node as a total loss of identity assurance for all workloads residing on that host.

Attack Chain

1. Attacker gains initial access to a Kubernetes node and escalates privileges to root.
2. Attacker inspects the SPIRE agent configuration to understand the required cgroup-based selectors for co-located workloads.
3. Attacker identifies a target workload's identity and its associated cgroup parameters on the compromised node.
4. Attacker creates a new process or container on the compromised node, configured with cgroup metadata matching the target workload's attributes.
5. Attacker executes the SPIRE Workload API client within the spoofed process environment.
6. The SPIRE agent collects the forged cgroup selectors from the attacker's process.
7. The SPIRE agent attests the process as the target workload and requests an SVID from the SPIRE server based on the matched registration entry.
8. The SPIRE server issues the legitimate SVID to the attacker, granting them the target workload's identity for subsequent abuse.

Impact

Successful exploitation allows for the complete impersonation of any workload co-located on a compromised node. This can result in unauthorized data exfiltration, lateral movement within a service mesh, and the bypass of identity-based authorization controls. Because these identities are cryptographically signed, the impersonation is highly credible to other services within the trust domain.

Recommendation

• Prioritize hardening of all Kubernetes nodes and restrict root access to reduce the likelihood of the initial node compromise.
• Minimize the attack surface by prohibiting privileged containers and restricting host access for sensitive workloads.
• Evaluate SPIRE registration policies to minimize reliance on weak or easily spoofed selectors.
• Use 'Spooffe' (as provided in the Unit 42 research) to audit existing workload selector configurations and assess potential impact if a node were compromised.
• Implement runtime security monitoring to detect unauthorized container escapes or unexpected process execution within critical namespaces.