# CVE-2025-0426: Unauthenticated Kubelet Checkpoint API Could Lead to Node DoS
> A critical kubelet bug exposes a DoS risk via the unauthenticated /checkpoint API. Learn how to detect, mitigate, and patch CVE-2025-0426.

Canonical: https://blog.abhimanyu-saharan.com/posts/cve-2025-0426-unauthenticated-kubelet-checkpoint-api-could-lead-to-node-dos
Published: 2025-05-23
Last updated: 2025-05-24
Authors: Abhimanyu Saharan
Categories: Security, Kubernetes

On **February 7, 2025**, the Kubernetes project disclosed a high-severity vulnerability: **CVE-2025-0426**. This issue affects the kubelet’s unauthenticated **read-only HTTP server**, allowing remote attackers to fill a node’s disk via repeated access to the **/checkpoint** API. If exploited, it results in a **Denial of Service (DoS)** condition that can take the node offline.

### CVSS Score: 7.5 (High)

`CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H`

## What Is the Issue?

The kubelet exposes a read-only HTTP server (default port `10255`) that is intended for unauthenticated status and metrics queries. In affected versions, this server also unintentionally exposes the `/checkpoint` API—used for container checkpointing—**without any authentication**.

When this API is called on a node with a runtime that supports checkpointing (like `containerd` with CRIU or `CRI-O` with `enable_criu_support=true`), it creates files under `/var/lib/kubelet/checkpoints`. With enough requests, this can **exhaust disk space**, causing system instability and eventual node failure.

## Affected Versions

Clusters running the following kubelet versions are vulnerable:

- `v1.32.0` – `v1.32.1`
- `v1.31.0` – `v1.31.5`
- `v1.30.0` – `v1.30.9`

> Note: Kubernetes v1.25 to v1.29 included the container checkpointing feature as an **alpha opt-in**. Unless explicitly enabled, those versions are not affected.

## Fixed Versions

The issue is resolved in the following kubelet releases:

- `v1.32.2`
- `v1.31.6`
- `v1.30.10`
- `v1.29.14`
- Kubernetes master branch (via [#129739](https://github.com/kubernetes/kubernetes/pull/129739))

## Who Is at Risk?

You are **vulnerable** if:

- You are running an affected version of kubelet.
- The **read-only port** is enabled and exposed.
- Your runtime supports **checkpointing** (e.g., `containerd` with CRIU or `CRI-O`).

You are **not vulnerable** if:

- The read-only port is disabled (`--read-only-port=0`).
- Your runtime does **not support** checkpointing (e.g., default `runc`, `crun`, or `youki` without CRIU).
- The `ContainerCheckpoint` feature gate is disabled (which is the default in most cases).

## How to Mitigate

If you cannot upgrade immediately, apply the following mitigations:

### 1. Disable the Read-Only Port

This blocks access to the unauthenticated HTTP server entirely:

```sh
--read-only-port=0
```

### 2. Disable the ContainerCheckpoint Feature Gate

This disables the vulnerable API endpoint:

```yaml
--feature-gates=ContainerCheckpoint=false
```

### 3. Upgrade kubelet

Upgrade to one of the patched versions to eliminate the vulnerability at its source.

## Detection and Monitoring

Signs of active exploitation may include:

- A high number of requests to `/checkpoint` on the kubelet's read-only port.
- An unexpectedly large volume of data or files under:

```sh
/var/lib/kubelet/checkpoints
```

To check:

```sh
find /var/lib/kubelet/checkpoints -type f | wc -l
```

If this number is unusually high, the node may be under a DoS attempt.

## Final Thoughts

This CVE highlights how seemingly minor features—like container checkpointing—can open up critical vulnerabilities when combined with misconfigured or legacy defaults like the kubelet’s read-only port. Even if your environment doesn’t actively use checkpointing, leaving unauthenticated endpoints exposed increases your overall attack surface.

> TIP: Best Practice
> Always disable the kubelet read-only port unless absolutely necessary.

If you discover indicators of compromise or suspect exploitation, report it to the Kubernetes security team at security@kubernetes.io.

## FAQ

### What is CVE-2025-0426 and why is it critical?

CVE-2025-0426 is a high-severity vulnerability in the Kubernetes kubelet that allows unauthenticated access to the `/checkpoint` API via the read-only port (default: 10255). If exploited, it can fill a node’s disk and cause a Denial of Service (DoS), taking the node offline.

### Which Kubernetes versions are affected by CVE-2025-0426?

Affected kubelet versions include:

- v1.32.0 – v1.32.1
- v1.31.0 – v1.31.5
- v1.30.0 – v1.30.9  
Earlier versions with the checkpointing feature as alpha (v1.25–v1.29) are not vulnerable unless explicitly enabled.

### How can I mitigate this vulnerability if I cannot upgrade immediately?

Mitigation steps include:

- **Disable the read-only port** (`--read-only-port=0`)
- **Disable the ContainerCheckpoint feature gate**
- **Monitor `/var/lib/kubelet/checkpoints`** for abnormal growth  
Upgrading to a patched kubelet version is strongly recommended.

### How can I detect if this vulnerability is being exploited?

Look for:

- Excessive requests to `/checkpoint` on port 10255
- Unusual file count or size in `/var/lib/kubelet/checkpoints`  
Use:  

```json
{
  "_key": "d98845d8059b",
  "_type": "code",
  "code": "find /var/lib/kubelet/checkpoints -type f | wc -l  ",
  "language": "sh"
}
```

### What kubelet versions contain the fix for CVE-2025-0426?

The issue is resolved in:

- v1.32.2
- v1.31.6
- v1.30.10
- v1.29.14
- Master branch via PR #129739