Kubernetes API Exposure
Exposed Kubernetes API servers allow attackers to query cluster information, deploy malicious workloads, or take over the entire cluster. Exposed dashboards and metrics endpoints are equally dangerous.
Overview
Kubernetes API servers exposed to the internet are regularly targeted by automated attacks. Attackers use tools like Shodan to find exposed clusters, then deploy cryptocurrency miners or establish persistence. Even read-only access exposes secrets, configurations, and cluster topology.
Types & Variants
API Server Exposure
Kubernetes API endpoint accessible from the internet.
Dashboard Exposure
Kubernetes Dashboard or other UIs publicly accessible.
Kubelet Exposure
Node kubelets accessible without authentication.
Impact
Complete cluster takeover, cryptomining deployment, data theft, lateral movement.
Examples
K8s API Discovery
curl https://exposed-cluster:6443/api/v1/namespaces # Returns namespace list
Remediation
Never expose K8s API to public internet. Use private endpoints or VPN. Disable anonymous authentication. Implement RBAC with least privilege.
Use private API endpoints
Require VPN for cluster access
Disable anonymous authentication
Implement network policies
Related SuperClue scanner checks
These scanner checks look for signs of Kubernetes API Exposure. What a scan can confirm from outside depends on your application.
Scan a domain you have verified with up to 350 modules, paid in credits.
See how website scanning works