Kubernetes instances exposed in open internet
Shadowserver Foundation has scanned internet for Kubernetes API servers and found roughly 380,000 that allow some form of access.
ShadowServer is conducting daily scans of the IPv4 space on ports 443 and 6443, looking for IP addresses that respond with an HTTP 200 OK status, which indicates that the request has succeeded.
More than 450,000 Kubernetes API instances identified by Shadowserver, 381,645 responded with “200 OK”. This does not mean these servers are fully open or vulnerable to attacks, but Shadowserver believes they represent an unnecessarily exposed attack surface and this level of access was likely not intended.
More than half of the exposed instances are located in the United States, with many also seen in Western Europe, Southeast Asia, and Australia.
The scans conducted by Shadowserver also show the Kubernetes version (1.17 through 1.22 are the most popular) and the platform (Linux/amd64 accounts for a vast majority of exposed instances).
Users who are notified about open instances have been advised to read the official guide on securing access to the Kubernetes API. Shadowserver recently also started conducting daily internet scans to identify exposed ICS and help organizations reduce their exposure to attacks.