The Hitchhiker's Guide to Kubernetes Vulnerabilities
Talkat KubeCon + CloudNativeCon North America 2021 · on Friday, 2021-10-15· at 15:25· Room 502 AB + Online·
summary
Historical analysis shows 39 vulnerabilities tied to Kubernetes releases with a big spike around 1.14 in 2019 and most recent discoveries driven by the bug bounty program. Data sources like NVD and CVE Details lag the mailing list, and researchers use tools such as semgrep to find repeated code patterns. The number of unique CWEs falls since 2020, suggesting low‑hanging fruit is fixed. Recommended actions: rescore CVSS per environment and stay within supported releases.
AI-written summary · about
chapters (17)
- 0:00Intro
- 0:58Introductions
- 1:33Why this talk
- 3:19What is a vulnerability
- 4:27Security Response Committee
- 4:59Lifetime of a kes vuln
- 6:41Security Supported Versions
- 7:52A brief history of K8s Security
- 9:01Where to get vulnerability data
- 11:56Vulnerability Distribution
- 17:35Issue Lifetime
- 19:20Bug Bounty Finds
- 20:14Common Weaknesses
- 21:17CWE - Kubernetes All Time
- 22:15CWE - 2020-2021
- 24:17CVSSv3 means rescoring!
- 27:21Key Takeaways
related talks
22mSecuring Kubernetes: Best Practices for DevSecOps in the Cloud-Native Era
29mHarder than You Think: Native Security in Kubernetes
34mCrafty Requests: Deep Dive Into Kubernetes CVE-2018-1002105
46mThe Hacker's Guide to Kubernetes
23mHitchhikers' Guide to the Vulniverse
25mThe State of Vulnerability in Cloud Native Security
56mCVE Is The Worst Vulnerability Framework (Except For All The Others)
36mThe Devil in the Details: Kubernetes’ First Security Assessment