CVE-2025-0426: Unauthenticated Kubelet Checkpoint API Could Lead to Node DoS

On February 7, 2025, the Kubernetes project disclosed a high-severity vulnerability: CVE-2025-0426. This issue affects the kubelet’s unauthenticated read-only HTTP server, allowing remote attackers to fill a node’s disk via repeated access to the /checkpoint API. If exploited, it results in a Denial of Service (DoS) condition that can take the node offline.

CVSS Score: 7.5 (High)¶

CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

What Is the Issue?¶

The kubelet exposes a read-only HTTP server (default port 10255) that is intended for unauthenticated status and metrics queries. In affected versions, this server also unintentionally exposes the /checkpoint API—used for container checkpointing—without any authentication.

When this API is called on a node with a runtime that supports checkpointing (like containerd with CRIU or CRI-O with enable_criu_support=true), it creates files under /var/lib/kubelet/checkpoints. With enough requests, this can exhaust disk space, causing system instability and eventual node failure.

Affected Versions¶

Clusters running the following kubelet versions are vulnerable:

• v1.32.0 – v1.32.1
• v1.31.0 – v1.31.5
• v1.30.0 – v1.30.9

Note: Kubernetes v1.25 to v1.29 included the container checkpointing feature as an alpha opt-in. Unless explicitly enabled, those versions are not affected.

Fixed Versions¶

The issue is resolved in the following kubelet releases:

• v1.32.2
• v1.31.6
• v1.30.10
• v1.29.14
• Kubernetes master branch (via #129739)

Who Is at Risk?¶

You are vulnerable if:

• You are running an affected version of kubelet.
• The read-only port is enabled and exposed.
• Your runtime supports checkpointing (e.g., containerd with CRIU or CRI-O).

You are not vulnerable if:

• The read-only port is disabled (--read-only-port=0).
• Your runtime does not support checkpointing (e.g., default runc, crun, or youki without CRIU).
• The ContainerCheckpoint feature gate is disabled (which is the default in most cases).

How to Mitigate¶

If you cannot upgrade immediately, apply the following mitigations:

1. Disable the Read-Only Port¶

This blocks access to the unauthenticated HTTP server entirely:

--read-only-port=0

2. Disable the ContainerCheckpoint Feature Gate¶

This disables the vulnerable API endpoint:

--feature-gates=ContainerCheckpoint=false

3. Upgrade kubelet¶

Upgrade to one of the patched versions to eliminate the vulnerability at its source.

Detection and Monitoring¶

Signs of active exploitation may include:

• A high number of requests to /checkpoint on the kubelet's read-only port.
• An unexpectedly large volume of data or files under:

/var/lib/kubelet/checkpoints

To check:

find /var/lib/kubelet/checkpoints -type f | wc -l

If this number is unusually high, the node may be under a DoS attempt.

Final Thoughts¶

This CVE highlights how seemingly minor features—like container checkpointing—can open up critical vulnerabilities when combined with misconfigured or legacy defaults like the kubelet’s read-only port. Even if your environment doesn’t actively use checkpointing, leaving unauthenticated endpoints exposed increases your overall attack surface.

Best Practice

Always disable the kubelet read-only port unless absolutely necessary.

If you discover indicators of compromise or suspect exploitation, report it to the Kubernetes security team at [email protected].