Home / Knowledge hub / Exposed Kubernetes dashboard
Knowledge hub
Exposed Kubernetes dashboard
A cluster admin screen reachable without proper sign-in.
What it means
The Kubernetes Dashboard is an optional web interface for viewing and managing a cluster. An exposed one is reachable from the internet, or from a wider network than intended, and either has no sign-in or accepts a weak one.
The dashboard acts with the permissions of the account behind it. If it runs with broad rights, anyone who reaches the page inherits them, and can view workloads, read configuration and start new containers.
Why it matters
The result can be full control of the cluster for a stranger. Attackers search the internet for these pages and use them to start crypto-mining workloads on your bill, or to read secrets and reach the data behind your services.
Because it is a web page, it is a simple finding to prove and a hard one to explain away. It reads as an unauthenticated admin screen on a production system.
How it shows up
The usual cause is a convenient setup: the dashboard service exposed through a load balancer or ingress, a skip-login option enabled, or a service account with cluster-admin rights attached to it. It often arrives with a tutorial and stays.
Do not expose it publicly. Reach it through kubectl proxy or a private network, require real sign-in, give it a narrow service account, or remove it if nobody uses it. Check from outside for the page, and for related exposure such as the kubelet API.
Questions people ask
Exposed Kubernetes dashboard, answered
Is the Kubernetes Dashboard installed by default?
No. It is an optional add-on. Some managed clusters and older guides install it, so check whether yours has it.
Why is skip login dangerous?
It lets a visitor use the dashboard with the dashboard's own service account, so the visitor gets whatever rights that account holds.
How do we check from the outside?
Scan your public addresses and ingress hosts for the dashboard page or its known paths. Also check that no load balancer fronts it.
Do we still need the dashboard?
Many teams use command-line tools and monitoring instead. If nobody opens it, remove it and shrink the attack surface.
What other cluster interfaces get exposed?
The API server itself, the kubelet, and the etcd data store. Each can give far-reaching access if left open.
Sources
Where this comes from
Related
Terms that sit next to this one
Kubernetes
A system that runs and manages containers across many machines.
Unauthenticated access
Anything your application answers without signing in at all.
Admin panel exposure
A management page left reachable by the public or by ordinary accounts.
Kubelet API exposure
An open node-level Kubernetes API that can run commands in pods.
Kubernetes RBAC
Rules for which accounts and services may do what inside a Kubernetes cluster.
Is an admin screen open to everyone?
We find admin pages and unauthenticated paths on your application and report only what we proved, with the evidence. Ask us to run it on one of your applications.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.