.png)
2025 and 2026 produced a real, citable stack of Kubernetes and container-runtime research: a rootkit built for Linux 6.x kernels, an eBPF backdoor caught live inside an EKS cluster, three separate runc escapes, an admission-controller RCE that hit a huge share of ingress-nginx deployments, and a whole class of kernel page-cache bugs that jump between processes, and between pods, with zero network traffic. CDRGoat now ships Kubernetes scenarios built around several of these findings, covering EKS, GKE, AKS, and on-prem. Go validate your SIEM, your agentic SOC, and the humans reading its output.
2.5 million people now use AI assistants every day, and that number keeps climbing. It's tempting to treat that as the headline of 2026 and rewrite the security playbook around it. Don't. Least-privilege RBAC still matters. Network segmentation still matters. Keeping node kernels patched still matters. None of that changed.
What changed is the timer. Ask a SOC that got hit this year how long the attack actually took, foothold to something that mattered, and a lot of them will say minutes, not hours. Not because the attacker found some exotic new bypass. Because an AI-driven operator doesn't pause to think, doesn't get tired at 3 AM, and doesn't need to read documentation before trying the next command. The basic recommendations you already know are still correct. You just have far less time to be slow about applying them.
CDRGoat was built for the first part of that problem: giving SOC teams a realistic cloud attack chain to validate detection and response against, at human pace. That's still true, and it's still useful. But the same framework now does double duty. If your SOC is starting to lean on agentic triage and response, CDRGoat is a way to find out whether those agents catch what a human analyst would, and whether they catch it fast enough to matter when the attacker is also running on AI time.
Kubernetes and container security just had back-to-back years on the DEF CON main stage: real-world Kubernetes attack tradecraft in 2025, GPU-driver container escapes on Nvidia infrastructure this August. Two years running isn't a coincidence, and neither is the pile of CVEs and named research that showed up alongside both talks. Most security teams I talk to have heard of maybe one or two of these. Here's the fuller list, kept brief, because the point isn't novelty, it's the accumulation.
So let's remember what actually happened over the last two years, roughly in order.
nodes/proxy GET looks like a harmless, read-only permission, and it's granted by default in 69+ Helm charts (Prometheus, Datadog Agent, and others). It isn't: a WebSocket quirk lets that "read-only" permission execute commands in any pod on a reachable node, leaving nothing but a routine get entry in the audit log. The Kubernetes Security Team closed it as Won't Fix, Working as Intended. We wrote this one up in detail back in January.
The ingress-nginx admission controller test-runs an NGINX config built from unvalidated Ingress annotations, and the wrong annotations turn that test run into RCE inside a pod that typically holds cluster-wide secret access. Disclosed in March 2025 as CVE-2025-1974, alongside four related CVEs. If your ingress controller has never been on your threat model, this is the year that stopped being defensible.
Three separate race conditions in how runc protects sensitive host paths, exploitable to bind-mount an attacker-chosen host path into a container instead of the safe path runc thinks it's masking. Disclosed together in November 2025. The same container-runtime boundary that produced Leaky Vessels back in 2024, leaking again.
Not a CVE, a tool: an actively maintained Linux kernel module rootkit built for current 6.x kernels. It's the technique behind CDRGoat's own kernel-rootkit scenario: compile a module from inside a container that's escaped to the host, and you have boot-persistent, kernel-level code execution that most container-focused tooling was never built to see.
If Singularity is the kernel-module answer, LinkPro is the eBPF one, and it wasn't a lab demo, it was found live during an incident response engagement inside an EKS cluster. It hides its own files and processes from standard tooling, then opens a covert backdoor triggered by a specially crafted packet. Proof that eBPF rootkits aren't theoretical anymore.
Three separate RBAC and authorization bypasses surfaced in etcd's own API within a few months of each other. None affect etcd as deployed inside a standard Kubernetes control plane, since kube-apiserver mediates all access, but etcd sits under every cluster secret. One was reportedly found by an autonomous AI pentesting run, a small sign the discovery side is speeding up too.
Copy Fail, CVE-2026-31431, made news in April: an unprivileged process corrupts a shared kernel cache entry instead of touching disk, letting it plant code that a completely different process later runs. Inside Kubernetes, where pods on a node share that same cache, one backdoored pod can hand code execution to a pod it never talked to. We published our own breakdown of that mechanism in May.
It turned out to be the first of a class, not a one-off. Five more CVEs, Dirty Frag, Fragnesia, PinTheft, DirtyClone, and pedit COW, landed between May and June, each a different way into the same underlying pattern, with the lineage tracing back to 2022's Dirty Pipe. Kubernetes-specific coverage of the newer ones is still thin, mostly a one-line "patch your nodes too," which is the gap CDRGoat's scenario is built to start closing.
Less a single vulnerability, more a reminder that the boring stuff still works at scale: a worm scanning for exposed Kubernetes API servers, Docker APIs, and Redis since December 2025, pivoting straight into credential theft and cryptomining. Same crew behind the LiteLLM supply-chain activity we covered in March. A misconfigured, internet-reachable API server remains one of the highest-volume initial access vectors into cloud infrastructure in 2026.
That's the landscape. CDRGoat's new Kubernetes scenarios are built to let you validate against a chunk of it directly, plus a few realistic misconfiguration chains that don't need a named CVE to be dangerous. Seven scenarios, EKS/GKE/AKS/on-prem, real infrastructure, fully automated attack chains:
CDRGoat's Kubernetes scenarios are open source and deployable against EKS, GKE, AKS, or a self-managed cluster. Each ships as a kubectl apply manifest plus a fully automated attack script that replays the chain end to end, so you watch it happen rather than take our word for it.
Run them against whatever you're using for detection. Run them against your SIEM. If you're further along and have agents doing first-pass triage, run them against those too, and then check whether the human reading the agent's output actually understands what happened in Kubernetes specifically, because "a pod got compromised" and "an uncompromised pod started running attacker code because a different pod corrupted a shared page cache entry" are not the same incident, and they don't get the same response.
This content is for educational purposes only. CDRGoat scenarios are intentionally vulnerable and must only be deployed in isolated, non-production environments. Stream.Security assumes no liability for misuse.
nodes/proxy authorization bypass research, the basis for our nodes/proxy to etcd injection scenariokubetcd, used in the on-prem etcd injection pathStream.Security is redefining cloud security for the age of AI. Built around CloudTwin™, our patented live system model, Stream provides security teams with a continuously updated, deterministic view of their entire environment, including cloud infrastructure, identities, Kubernetes, networks, SaaS applications, and AI workloads. Rather than relying on fragmented logs and periodic scans, CloudTwin computes the real-time state of your environment, enabling every detection, investigation, and response to be grounded in complete, accurate context. Trusted by cloud-native enterprises and recognized as a Gartner® Cool Vendor in Modern SecOps, Stream.Security is building the intelligence layer that enables humans and AI agents to defend modern infrastructure with speed, precision, and confidence.
