---
vid: KHV042
title: Exposed Attaching To Container
categories: [Remote Code Execution]
---

# {{ page.vid }} - {{ page.title }}

## Issue description

An attacker could attach to a running container via a websocket on the kubelet's `/attach` endpoint. This endpoint is exposed as part of the kubelet's debug handlers.

## Remediation

Disable `--enable-debugging-handlers` kubelet flag.

## References

- [kubelet server code](https://github.com/kubernetes/kubernetes/blob/4a6935b31fcc4d1498c977d90387e02b6b93288f/pkg/kubelet/server/server.go)
- [Kubelet - options](https://kubernetes.io/docs/reference/command-line-tools-reference/kubelet/#options)