6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2025-0426

CVE-2025-0426: Node Denial of Service via kubelet Checkpoint API

A security issue was discovered in Kubernetes where a large number of container checkpoint requests made to the unauthenticated kubelet read-only HTTP endpoint may cause a Node Denial of Service by filling the Node's disk.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2025-0426

CVE-2025-0426:

6.2

CVSS Score

3.1

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
k8s.io/kubernetes	go	>= 1.32.0, < 1.32.2	1.32.2
k8s.io/kubernetes	go	>= 1.31.0, < 1.31.6	1.31.6
k8s.io/kubernetes	go	>= 1.30.0, < 1.30.10	1.30.10
k8s.io/kubernetes	go	< 1.29.14	1.29.14

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability occurs because the kubelet's Checkpoint API was exposed on an unauthenticated read-only HTTP endpoint. The provided patches (e.g., bda81f1b68e22671e5e26953f0086ac6fca9d8aa) show that the registration of the '/checkpoint' route, which is handled by the 's.checkpoint' method, was moved from the InstallDefaultHandlers function to the InstallDebuggingHandlers function. InstallDefaultHandlers sets up the unauthenticated read-only port, while InstallDebuggingHandlers typically sets up authenticated endpoints. Therefore, InstallDefaultHandlers was the function that incorrectly exposed the checkpointing functionality without authentication, and s.checkpoint (which resolves to k8s.io/kubernetes/pkg/kubelet/server.(*Server).checkpoint) is the function that processes these potentially malicious requests, leading to disk exhaustion.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.