Kubernetes Secrets API Exposure Probe for 2026-10-19
Last Updated: 00:00 UTC
Direct requests to /api/v1/namespaces/{ns}/secrets attempt to read all Kubernetes secrets in the namespace from a misconfigured or unauthenticated kube-apiserver. A successful response exposes service account tokens, TLS keys, and application credentials.
MITRE ATT&CK
Tactic: Credential Access (TA0006)
Technique: T1552.007 — Container API
Observed URIs
Attackers by Country
| France | 9 | 60.0% |
| Sweden | 3 | 20.0% |
| Poland | 1 | 6.7% |
| South Africa | 1 | 6.7% |
| Iran | 1 | 6.7% |
IP Address : ASN : City/Provider
-
149.50.97.236 : AS201814 MEVSPACE sp. z o.o. : Warsaw
-
185.177.72.12 : AS211590 Bucklog SARL : France
-
185.177.72.13 : AS211590 Bucklog SARL : France
-
185.177.72.17 : AS211590 Bucklog SARL : France
-
185.177.72.22 : AS211590 Bucklog SARL : France
-
185.177.72.24 : AS211590 Bucklog SARL : France
-
185.177.72.38 : AS211590 Bucklog SARL : France
-
185.177.72.60 : AS211590 Bucklog SARL : France
-
185.177.72.67 : AS211590 Bucklog SARL : France
-
185.177.72.68 : AS211590 Bucklog SARL : France
-
192.142.226.23 : AS399138 Microlink Network : South Africa
-
198.167.197.162 : AS39287 Materialism s.r.l. : Sweden
-
198.167.197.194 : AS39287 Materialism s.r.l. : Sweden
-
198.167.197.204 : AS39287 Materialism s.r.l. : Sweden
-
62.60.131.218 : AS208137 Feo Prest SRL : Tehran