K10: Outdated and Vulnerable Components

📋 What Is It?

Outdated and Vulnerable Components is running Kubernetes, its add-ons, or the underlying node OS and container runtime at versions with known, publicly documented vulnerabilities - or past end-of-support with no security fixes at all. A cluster is a stack of independently versioned parts: control plane, per-node kubelet/kube-proxy, container runtime (containerd/CRI-O/runc), node kernel, CNI, CSI, ingress controller, dashboard, and mesh sidecars. Each accrues CVEs on its own cadence. The weakness is not a subtle flaw to discover - it is a published advisory with a patch already available, applied everywhere except your cluster.

K10 OWASP Rank

N, N-1, N-2 Supported

By Catalogue Exploited

⚠️ Common Exploits

Version Fingerprinting: /version, node metadata, banners advertise the target
Ingress RCE: internet-facing controller reachable with no cluster credentials (IngressNightmare class)
Runtime Escape: unpatched runc/containerd breaks a pod out to the node (runc-escape class)
Kubelet / API-Server Privesc: historic patched flaws reach further than intended
EOL Kernel LPE: unsupported node OS never gets kernel patches
Stale Add-ons: old Dashboard auth bypass, mesh proxy CVEs across every pod
Version Skew Debt: falling behind eventually blocks safe upgrades entirely

🔴 Attack Flow

1. Fingerprint - read version banners, /version, image tags, node metadata
↓
2. Match - look the version up in public advisories / exploit databases
↓
3. Exploit - run the existing exploit (ingress RCE, runtime escape, privesc)
↓
4. Escape / Escalate - break out to the node, harvest tokens and secrets
↓
5. IMPACT: Container escape, infra RCE, cluster-wide takeover!

❌ Vulnerable Code

# Bad: "we're on a recent version, probably" - no inventory
$ kubectl version --short
Server Version: v1.22.x      ← end-of-life: no more security patches

# Bad: version skew far outside the supported window
$ kubectl get nodes          ← control plane v1.24, some kubelets v1.19
# Only path forward is a risky, untested multi-minor emergency jump.

# Bad: the version banner is handed to any attacker who asks
GET /version HTTP/1.1
-> { "gitVersion": "v1.22.x" }   ← match to a public advisory

# Bad: only application images scanned, only at build time
$ grype app:latest           ← blind to kubelet, runtime, ingress, CNI

# Bad: nodes patched by hand "when we get a maintenance window"
# Kernel + runc security updates sit unapplied for months -
# the runc-escape and kernel-LPE classes stay exploitable on every node.

# Bad: a demo Dashboard from two years ago, still running, still old
$ kubectl get deploy -A | grep -i dashboard   ← unauthenticated, unpatched
                

✅ Secure Code

# Good: inventory every version-bearing layer, compare to upstream + EOL
$ kubectl version                    ← client + API server
$ kubectl get nodes -o wide          ← kubelet, kernel, OS, runtime per node
# Record current vs. latest vs. EOL date, with an OWNER, for:
# k8s minor, kubelet, runtime, runc, node OS/kernel, CNI, CSI, ingress, mesh.

# Good: scan the CLUSTER, not just images - in CI and on a schedule
$ trivy k8s --report summary cluster           ← control plane + nodes + workloads
$ kubescape scan framework nsa,mitre           ← outdated-component controls
$ grype registry.example.com/app:1.4.2 --fail-on high   ← gate images in CI

# Good: upgrade ONE minor at a time, control plane first, within skew
$ kubectl drain node-1 --ignore-daemonsets --delete-emptydir-data
# (upgrade node image, then)
$ kubectl uncordon node-1            ← validate on a canary pool before the fleet

# Good: automate node OS/kernel/runtime patching with kured
kind: DaemonSet
metadata: { name: kured, namespace: kube-system }
# OS applies updates → kured cordons+drains ONE node → reboots → uncordons,
# respecting PodDisruptionBudgets. Managed pools: prefer node auto-upgrade.
                

✓ Prevention Checklist

Maintain a versioned inventory of every component + owner + EOL date
Keep Kubernetes on a supported minor (roughly latest three); never run EOL
Keep kubelets within the supported skew of the API server
Patch the container runtime and runc on every node
Keep node OS/kernel on a supported release with updates applied
Track advisories for ingress, CNI, CSI, dashboard, and mesh
Subscribe to the Kubernetes security-announce feed
Scan the cluster (Trivy k8s, kubescape), not only images
Upgrade one minor at a time, tested on a canary first
Automate node patching (kured, managed node pools)
Remove unused add-ons; pin and track the rest via Helm/GitOps
Retire dockershim/legacy Docker; keep management surfaces private

🔍 Detection & Tools

Kubernetes Tools:

Trivy (k8s) kubescape Grype kube-bench Polaris

Patch Automation:

kured Managed Node Pools Helm / GitOps Bottlerocket

How to Test:

kubectl get nodes -o wide - check kubelet, kernel, OS, runtime versions
Confirm the Kubernetes minor is inside the supported window (not EOL)
trivy k8s --report all --severity HIGH,CRITICAL cluster
Run kubescape against nsa/mitre frameworks on a schedule
Verify kubelet-to-API-server skew is within bounds on every node

🌍 Real-World

Ingress-Controller RCE (IngressNightmare class): publicly disclosed flaws in widely used ingress controllers let a crafted request or Ingress object inject config or execute code in the internet-facing controller pod - which can read TLS Secrets and watch cluster resources. Clusters never upgraded stayed exploitable long after a fix shipped.
Container Runtime Escape (runc-escape class): disclosed flaws in runc let a malicious container overwrite the host runc binary or break isolation and run on the node - turning one pod into control of every pod, Secret, and token scheduled there.
Kubelet / API-Server Privilege Escalation: historic patched flaws let a limited client escalate or reach endpoints without proper authorization - the defense is simply being on a patched version.

Described as vulnerability classes tied to well-known public events - specific CVE identifiers and figures deliberately omitted. The durable lesson is the pattern, not a number.

📌 Quick Tips

DO NOT run an end-of-life Kubernetes minor or node OS
DO NOT let kubelets drift outside the supported skew
DO NOT assume image scanning covers the cluster stack
DO inventory every component and its EOL date
DO scan the cluster and upgrade one minor at a time
DO automate node OS, kernel, and runtime patching
DO remove unused add-ons and keep surfaces private

📜 Related Risks

Connected OWASP Kubernetes Top 10:

K09 Misconfigured Components - configuration vs. version
K02 Supply-Chain - vulnerable images and dependencies
K07 Missing Segmentation - keep stale surfaces unreachable
K01 Insecure Workloads - the pod an escape starts from

📦 Outdated and Vulnerable Components