Engineer for the future of Cloud
June 10-13, 2019
San Jose, CA

Crafty requests: Deep dive into a Kubernetes CVE

Ian Coldwater (Independent)
3:50pm4:30pm Wednesday, June 12, 2019
Building Secure Systems
Location: LL21 E/F



Prerequisite knowledge

  • Background knowledge of Kubernetes (useful but not required)

What you'll learn

  • Understand what you can do to to protect yourself from CVE-2018-1002105


You may have heard about CVE-2018-1002105, one of the most severe Kubernetes security vulnerabilities of all time. But how does this flaw work? How can it be exploited, and what does it all mean?

Ian Coldwater walks you through the Kubernetes backend, going over relevant concepts like aggregated API servers, the kubelet API, and permissions for namespace-constrained users. Ian explains how this flaw works, how a cluster’s moving parts can fit together to create a vulnerable context, and the risks involved in leaving this CVE unpatched in the wild.

A live demonstration shows you exactly how easy it is to exploit this vulnerability. After explaining the attack pathways, you’ll leave with practical advice about mitigation and how to protect your clusters.

Photo of Ian Coldwater

Ian Coldwater


Ian Coldwater is a DevSecOps engineer turned red teamer who specializes in breaking and hardening Kubernetes, containers, and cloud native infrastructure. In their spare time, they like to go on cross-country road trips, capture flags, and eat a lot of pie. Ian lives in Minneapolis and tweets @IanColdwater.

Leave a Comment or Question

Help us make this conference the best it can be for you. Have questions you'd like this speaker to address? Suggestions for issues that deserve extra attention? Feedback that you'd like to share with the speaker and other attendees?

Join the conversation here (requires login)