CVE-2025-0426: Kubernetes Kubelet DoS Vulnerability

CVE-2025-0426 Overview

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk. This vulnerability allows attackers with local access to exploit the kubelet's checkpoint functionality to exhaust disk resources on Kubernetes nodes.

Critical Impact
Attackers can cause Node Denial of Service by exhausting disk space through repeated container checkpoint requests to the unauthenticated kubelet read-only endpoint, potentially disrupting containerized workloads across the cluster.

Affected Products

Kubernetes (kubelet component)
Kubernetes clusters with read-only kubelet endpoint enabled
Container orchestration environments using affected Kubernetes versions

Discovery Timeline

February 13, 2025 - CVE-2025-0426 published to NVD
February 13, 2025 - Last updated in NVD database

Technical Details for CVE-2025-0426

Vulnerability Analysis

This vulnerability is classified as a Resource Exhaustion issue (CWE-400: Uncontrolled Resource Consumption). The kubelet component in Kubernetes exposes a read-only HTTP endpoint that does not require authentication by default. This endpoint includes functionality for container checkpointing, which creates disk-based snapshots of running containers.

The core issue stems from the lack of rate limiting or resource quotas on the checkpoint request functionality. An attacker with local access to a Kubernetes node can issue a high volume of container checkpoint requests, causing the kubelet to generate numerous checkpoint files. These files accumulate on the node's filesystem without proper cleanup mechanisms being triggered during the attack, ultimately filling the available disk space.

When disk space is exhausted, the affected node can no longer perform critical operations including container scheduling, log writing, and system maintenance tasks. This effectively renders the node unavailable, impacting all workloads scheduled on that node.

Root Cause

The root cause is improper resource management in the kubelet's read-only HTTP endpoint. Specifically, the checkpoint request handler lacks adequate controls to prevent abuse:

No Authentication Required: The read-only endpoint operates without authentication by default, allowing any local process to make requests
Missing Rate Limiting: There are no restrictions on the frequency or volume of checkpoint requests
Insufficient Disk Quota Enforcement: The checkpoint functionality does not enforce disk usage limits before creating new checkpoint files
Lack of Automatic Cleanup: Old or excessive checkpoint files are not automatically purged under resource pressure

Attack Vector

The attack requires local access to the Kubernetes node where the kubelet is running. An attacker must be able to reach the kubelet's read-only HTTP endpoint, typically exposed on port 10255. The attack is executed by sending a flood of checkpoint requests to the endpoint, causing rapid disk consumption.

The attacker does not need any special privileges or authentication tokens to exploit this vulnerability. Simply having network access to the kubelet's read-only port from within the node or a co-located container is sufficient to trigger the denial of service condition.

The attack progresses by repeatedly requesting container checkpoints through the unauthenticated endpoint. Each checkpoint consumes disk space, and without rate limiting, an attacker can quickly exhaust available storage. Once disk space is depleted, the node becomes unresponsive to legitimate workload operations.

Detection Methods for CVE-2025-0426

Indicators of Compromise

Unusual spike in disk usage on Kubernetes nodes, particularly in kubelet checkpoint directories
High volume of HTTP requests to the kubelet read-only endpoint on port 10255
Presence of numerous checkpoint files with timestamps clustered in a short time period
Node status changes to NotReady or DiskPressure conditions in cluster monitoring

Detection Strategies

Monitor kubelet read-only endpoint access logs for abnormal request patterns targeting checkpoint functionality
Implement disk usage alerts that trigger when node storage exceeds defined thresholds
Deploy network monitoring to detect unusual traffic volumes to kubelet ports from within the cluster
Use Kubernetes event monitoring to track DiskPressure node conditions

Monitoring Recommendations

Configure alerting on rapid disk consumption rates on Kubernetes nodes
Set up network flow analysis for kubelet endpoint traffic patterns
Implement log aggregation for kubelet access logs to identify request anomalies
Enable Kubernetes audit logging to track checkpoint-related API activities

How to Mitigate CVE-2025-0426

Immediate Actions Required

Disable the kubelet read-only port (--read-only-port=0) if not required for monitoring purposes
Implement network policies to restrict access to kubelet endpoints from untrusted pods
Configure disk usage quotas and monitoring on Kubernetes nodes
Review and restrict which containers have network access to node-level services

Patch Information

Organizations should monitor the Kubernetes Security Announcement for official patch releases. The GitHub Issue Discussion provides additional technical context and tracks the resolution progress. The OpenWall OSS Security Update contains supplementary security information.

Workarounds

Disable the read-only kubelet port by setting --read-only-port=0 in kubelet configuration
Use network policies to block access to port 10255 from non-essential services
Implement pod security policies that prevent containers from accessing host network
Configure disk usage limits and alerts to detect potential abuse early

bash

# Configuration example
# Disable kubelet read-only port in kubelet configuration
# Add to kubelet configuration file or command line arguments:
--read-only-port=0

# Or in kubelet config file (kubelet-config.yaml):
# readOnlyPort: 0

# Apply network policy to restrict kubelet endpoint access
# kubectl apply -f kubelet-network-policy.yaml