CyberHunter
LinkedIn profile - Bastien Cordier Email: contact@bastiencordier.pro
// DevOps, cloud & containers

Port 10250: Kubelet API

Kubelet API on every Kubernetes node.

10250

How Kubelet API works

DevOps, cloud & containers
adminhostexec adminhostexec

Commands sent to port 10250 create and control containers or cluster resources on the host. Everything is encrypted: someone on the path only sees unreadable bytes.

Transport
TCP
Exposure risk
9/10 critical if reachable from the Internet
Encryption
EncryptedTLS or built-in crypto
IANA status
Unassignedcommon use differs from the registry
Range
Registered (1024-49151)
Category
DevOps, cloud & containers
01 Security

Is port 10250 dangerous?

Common attacks and weaknesses

  • Anonymous kubelet access allows command execution in any pod on the node.

How to secure it

  • Set --anonymous-auth=false and --authorization-mode=Webhook.
  • Firewall node ports from outside the cluster.

Unofficial use. The IANA assignment below differs from what is usually found on this port in practice.

02 Registry

IANA registry entries for port 10250

No entry. The port is free for any application, so check what uses it on your hosts.

// source: IANA service name and port number registry

03 Check it

Which program uses port 10250, and is it reachable?

Linux

sudo ss -ltnup 'sport = :10250'      # process listening on 10250
sudo lsof -nP -i :10250

macOS

sudo lsof -nP -i :10250

Windows (PowerShell)

Get-NetTCPConnection -LocalPort 10250 -State Listen | Select LocalAddress, OwningProcess
Get-NetUDPEndpoint -LocalPort 10250
netstat -ano | findstr :10250

From another machine

nmap -p 10250 -sV <host>
nc -zv <host> 10250

Block it in the firewall

sudo ufw deny 10250/tcp                                         # Linux (ufw)
New-NetFirewallRule -DisplayName "Block 10250" -Direction Inbound -LocalPort 10250 -Protocol TCP -Action Block  # Windows
04 FAQ
What is port 10250 used for?

Kubelet API on every Kubernetes node.

Is port 10250 TCP or UDP?

Port 10250 is registered for TCP.

Is it safe to open port 10250?

It is rated 9/10 (critical) when exposed to the Internet. Anonymous kubelet access allows command execution in any pod on the node. Set --anonymous-auth=false and --authorization-mode=Webhook.

How do I check if port 10250 is open?

On Linux run "ss -ltnup 'sport = :10250'", on macOS "lsof -nP -i :10250", and on Windows "netstat -ano | findstr :10250" to see the local process. From another machine, "nmap -p 10250 <host>" shows whether it is reachable.

05 Related
:2375 Docker API (HTTP) tcp · critical risk :2376 Docker API (TLS) tcp · high risk :6443 Kubernetes API tcp · udp · high risk :2379 etcd tcp · critical risk :8500 Consul tcp · udp · high risk :4505 SaltStack tcp · critical risk :9000 PHP-FPM / SonarQube / Portainer tcp · udp · high risk :677 Virtual Presence Protocol tcp · udp

Latest vulnerability news

All news