Over 900,000 Kubernetes Instances Found Exposed Online
Kubernetes is one of the most popular open-source container orchestration systems.
Updated
On this page
Updated November 2026. This was first published on 4 August 2022. The idea is the same. Any number below is what the original piece said then. It is not a new count.
Key takeaways
- Kubernetes is one of the most popular open-source container orchestration systems.
- makes Docker, Containers, and CRI-O work easy and smooth.
- Kubernetes also helps in automating software management, deployment, and scaling.
Kubernetes is one of the most popular open-source container orchestration systems. makes Docker, Containers, and CRI-O work easy and smooth. Kubernetes also helps in automating software management, deployment, and scaling.
Initially, Google designed this project, but Cloud Native Computing Foundation currently maintains the complete project. Many reports claim millions of Kubernetes clusters are available on the internet.
Recently, Cyble Research Labs reported that over 900,000 misconfigured Kubernetes clusters were discovered online. Among these 900,000 misconfigured Kubernetes clusters, some were open to data-exposure hacks and potentially harmful scanning.
Exposed Kubernetes Instances Can Cause Breaches #
Kubernetes provides adaptability, scalability, portability, cost, system deployment, app development, and time reductions in a multi-cloud environment. As an open-source software with multi-cloud what it does, it gets easy for cybercriminals to breach internal resources and private assets if your Kubernetes is not set up properly.
Recently, a report highlighted how cybercriminals are targeting Kubernetes- Where they can sometimes expand their authorizations from containers to break isolation depending on the configuration. After this, they rotate to host processes that grant them initial access to internal corporate networks to proceed with further assaults.
Cyble researchers, in their observation, detected misconfigured Kubernetes instances capable of exposing thousands of companies.
Kubernetes-master Kubernetes dashboard Favicon:2130463260, -1203021870 Kubernetes Kube K8.
Later in the report, the threat-hunting exercise highlights some risk exposure.
The highest exposure count is for the United States (65%), followed by China (14%) and Germany (9%).
The top three ports in use are 10250, 443, and 6443.
Kubernetes Security Risks #
When the use case is high, the risk ratio increases as many companies manage their applications with Kubernetes using “pods,” the self-contained units. These “pods” share common resources with other units, and throughout the process, they are unaware of each other.
For example, “go run” or “npm start” processes are used in pods to share some CPU and RAM.
K8s help manage, deploy, and scale containers, which sometimes consist of different micro-services and configuration files. Kubernetes is so designed that it can automatically handle situations when the workload increases or decreases.
The most crucial security aspect of Kubernetes is access control, as a slight misconfiguration can result in unwanted disclosures. This will eventually invite attackers to use escape containers and escalate privileges.
Moreover, there are some other functions as well in Kubernetes that attract hackers, like- CLI commands, APIs, and user interfaces.
But, in the end, Cyble confirms that all exposed instances are not vulnerable to attacks or will lead to data leaks. Still, with simple misconfiguration practices, companies may be lucrative targets for TAs in the future.
How to Protect Kubernetes #
Indeed, you cannot anticipate everything, but with some good practices, you can avoid maximum chances of security breaches for Kubernetes pods.
To spot misconfiguration, run regular vulnerability scans against containers.
Instead of using hard-coded credentials, use Kubernetes secrets in configuration files.
When authentication is not strong by default, make it hard manually.
Check for any updates or security patches and apply if available.
Check for useless and no longer components and remove them.
When Kubernetes APIs return error codes, make sure to be extra-vigilant. This is because error codes help hackers to determine whether they can access the container files or not; if yes, then how?
For example, when there is a 403 error code, hackers stop attacking because the 403 error is an access restricted error. It occurs when your Kubelet API, which handles communications between the nodes and the Kubernetes control plane, accepts unauthenticated requests.
But, hackers might try other exploits when it returns a 401 error. This error pops when there’s an error in the Kubernetes cluster functioning primarily due to the running environment.
Cyble’s results also revealed that a specific status code is completely exposed to external attackers and is returned by a subset of 799 Kubernetes instances- this is status code 200.
During these cases, threat actors can easily access the nodes on the Kubernetes Dashboard even without a password. Also, they can access all secrets and perform other actions.
Two main elements found in the research that were exposed are.
Worker nodes (also called Kubelet) - The interface to nodes.
Kubernetes control plane (also called API server) - The interface to control cluster.
Even though Kubernetes deployments best practices recommend isolating access to KubeAPI servers with bastion hosts, many remain openly exposed to the internet, as the research shows.
Conclusion #
Kubernetes is one of the most popular open-source container orchestration systems, so there’s always a chance of uneven security breaches. After this guide, you probably know why such a situation occurs and how over 900,000 Kubernetes instances are found exposed.
With best practices and threat prevention, you can use Kubernetes for Docker, Containers, and CRI-O working. Kubernetes also helps in automating software management, deployment, and scaling.
Questions and answers #
What is the main point? #
Kubernetes is one of the most popular open-source container orchestration systems.
What else did the original piece say? #
makes Docker, Containers, and CRI-O work easy and smooth.