K06: Broken Authentication Mechanisms

📋 What Is It?

Broken Authentication is running a cluster where the question "who is making this request?" is answered weakly, incompletely, or not at all. Kubernetes delegates identity to a chain of pluggable methods (client certs, bearer tokens, ServiceAccount tokens, OIDC, authenticating proxies). Authentication is the first gate: break it and RBAC (K03) is handed the wrong subject - system:anonymous or a stolen ServiceAccount - so every downstream control reasons about the wrong principal. Authentication is also spread across the API server, every kubelet, and etcd, each authenticating independently.

K06 OWASP Rank

First Gate Focus Area

Takeover Impact

⚠️ Common Exploits

Anonymous API Access: --anonymous-auth=true maps failed auth to system:anonymous
Unauthenticated Kubelet (10250): anonymous auth + AlwaysAllow gives pod exec/logs
Exposed etcd (2379): no client-cert auth = full cluster state, all Secrets
Stolen SA Tokens: mounted tokens read from a pod and replayed against the API
Legacy Non-Expiring Tokens: a leaked token replayable forever, from anywhere
Leaked kubeconfigs / Certs: O=system:masters certs that cannot be revoked
Static Token / Basic-Auth Files: flat-file bearer creds with no expiry

🔴 Attack Flow

1. Discover reachable control-plane ports (6443, 10250, 2379)
↓
2. Send unauthenticated request - is anonymous accepted?
↓
3. Obtain a credential - read mounted SA token or harvest kubeconfig
↓
4. Authenticate / replay against the API or kubelet
↓
5. IMPACT: Read Secrets, exec into pods, full cluster takeover!

❌ Vulnerable Code

# Bad: API server accepts anonymous + static credential files
kube-apiserver \
  --anonymous-auth=true            ← failed auth → system:anonymous
  --token-auth-file=/etc/kubernetes/tokens.csv   ← static bearer creds
  --basic-auth-file=/etc/kubernetes/basic.csv    ← legacy user/password

# Bad: an accidental binding makes it catastrophic
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
subjects:
  - kind: Group
    name: system:unauthenticated   ← anyone, no credential, can read

# Bad: kubelet wide open on port 10250
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authentication:
  anonymous:
    enabled: true          ← anonymous callers accepted
authorization:
  mode: AlwaysAllow        ← every request authorized (exec/logs/pods)

# Bad: legacy non-expiring SA token, auto-mounted and stealable
apiVersion: v1
kind: Secret
type: kubernetes.io/service-account-token   ← never expires, any audience
                

✅ Secure Code

# Good: reject the unauthenticated; no static credential files
kube-apiserver \
  --anonymous-auth=false           ← 401 instead of an anonymous identity
  # (no --token-auth-file, no --basic-auth-file)
  --oidc-issuer-url=https://idp.example.com   ← humans via OIDC + MFA
  --oidc-groups-claim=groups

# Good: kubelet requires auth and delegates authz to the API server
apiVersion: kubelet.config.k8s.io/v1beta1
kind: KubeletConfiguration
authentication:
  anonymous:
    enabled: false         ← no anonymous access
  webhook:
    enabled: true          ← verify bearer tokens via API server
  x509:
    clientCAFile: /etc/kubernetes/pki/ca.crt
authorization:
  mode: Webhook            ← NOT AlwaysAllow

# Good: etcd requires mutual TLS, control-plane-only listeners
etcd --client-cert-auth=true \
  --trusted-ca-file=/etc/kubernetes/pki/etcd/ca.crt \
  --listen-client-urls=https://127.0.0.1:2379,https://10.0.0.10:2379

# Good: projected, audience-bound, short-lived SA token (auto-rotated)
volumes:
  - name: api-token
    projected:
      sources:
        - serviceAccountToken:
            audience: api             ← scoped, not "any"
            expirationSeconds: 3600   ← short-lived, then rotated
                

✓ Prevention Checklist

Disable anonymous auth (--anonymous-auth=false)
Verify no binding grants system:unauthenticated
Require kubelet auth + Webhook authz (no AlwaysAllow)
Protect etcd with mutual TLS; keep it control-plane-only
Enable encryption at rest for Secrets
Use short-lived, audience-bound projected SA tokens
Set automountServiceAccountToken: false by default
Integrate OIDC/SSO with MFA for human access
Remove static token and basic-auth files
Keep client certs short-lived, scoped, and rotated
Never expose the API server, kubelet, or dashboards publicly
Keep cloud-IAM-to-RBAC mapping least-privilege

🔍 Detection & Tools

Kubernetes Tools:

kube-bench kubeaudit kubescape Trivy Falco Polaris

Policy Enforcement:

OPA/Gatekeeper Kyverno NodeRestriction

How to Test:

Probe the API anonymously: curl -sk https://API:6443/api
Check kubelet: curl -sk https://NODE:10250/pods
kube-bench run --targets master,node flags anonymous auth
Audit legacy tokens: kubectl get secrets -A --field-selector type=kubernetes.io/service-account-token
Confirm no binding to anonymous groups (see checklist jq)

🌍 Real-World

Exposed Admin Dashboards: Management UIs (e.g. the Kubernetes Dashboard) deployed with no authentication and reachable from the internet - the well-documented "Tesla-class" cryptojacking exposure pattern.
Unauthenticated Kubelet & etcd: Node APIs on 10250 left with anonymous auth on, or etcd reachable without mutual TLS - a direct path from network reachability to pod exec or full cluster-state disclosure.
Leaked Long-Lived Credentials: kubeconfigs and legacy token Secrets committed to source control or CI logs. Kubernetes has no cert revocation, so a leaked long-lived cert is a durable backdoor.

Exact incident counts vary by source; treat any single figure as illustrative. The durable takeaway: broken auth is common, trivially detectable, and catastrophic.

📌 Quick Tips

DO NOT enable anonymous auth on any component
DO NOT use long-lived shared system:masters certs
DO NOT expose the API server, kubelet, or etcd publicly
DO authenticate every door independently
DO use short-lived, audience-bound tokens
DO federate humans via OIDC/SSO with MFA
DO rotate certificates and audit for anonymous access

📜 Related Risks

Connected OWASP Kubernetes Top 10:

K03 Overly Permissive RBAC - what an identity may do
K08 Secrets Management Failures - what auth protects
K05 Inadequate Logging & Monitoring - detecting abuse
K09 Misconfigured Cluster Components

🔑 Broken Authentication Mechanisms