# The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE

DevFeed: [The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE](<https://devfeed.tech/articles/the-machine-with-many-faces-post-exploitation-identity-misuse-in-spiffe-spire-7753.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/kubernetes-spiffe-spire-identity-spoofing/>)

Author: Eviatar Garzi

Published: 2026-09-10T10:00:43Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Kubernetes](<https://devfeed.tech/topics/kubernetes.md>)

Tags: [api](<https://devfeed.tech/tags/api.md>), [containers](<https://devfeed.tech/tags/containers.md>), [cryptographic](<https://devfeed.tech/tags/cryptographic.md>), [identity](<https://devfeed.tech/tags/identity.md>), [json](<https://devfeed.tech/tags/json.md>), [kubernetes](<https://devfeed.tech/tags/kubernetes.md>), [linux](<https://devfeed.tech/tags/linux.md>), [malware](<https://devfeed.tech/tags/malware.md>), [node](<https://devfeed.tech/tags/node.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [research](<https://devfeed.tech/tags/research.md>), [secrets](<https://devfeed.tech/tags/secrets.md>), [spiffe](<https://devfeed.tech/tags/spiffe.md>), [spire](<https://devfeed.tech/tags/spire.md>), [spoof](<https://devfeed.tech/tags/spoof.md>), [spoofing](<https://devfeed.tech/tags/spoofing.md>), [threat-research](<https://devfeed.tech/tags/threat-research.md>), [tool](<https://devfeed.tech/tags/tool.md>)

## AI overview

Research on a post-exploitation technique in which root access to a Kubernetes node can let an attacker spoof cgroup metadata used by SPIRE workload attestation, impersonate co-located workloads, and obtain SVIDs.

## Source excerpt

Learn how root access on a compromised K8s node allows attackers to utilize SPIFFE/SPIRE metadata to spoof and harvest co-located workload identities. The post The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE appeared first on Unit 42.