KHV041 - Exposed Port Forward

Issue description

An attacker could read and write data from a pod via the kubelet’s /portForward endpoint. This endpoint is exposed as part of the kubelet’s debug handlers.

Remediation

Disable --enable-debugging-handlers kubelet flag.

References

• kubelet server code
• Kubelet - options