# Kubelet resource exhaustion attack via metric label cardinality explosion from unauthenticated requests

Unauthenticated requests with random paths to kubelet's HTTP server create unbounded metric label cardinality, exhausting memory and OOM-killing or evicting workloads.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by (vendor credit): Henrik Schmidt
- Found by: mr_incompetent
- Disclosed: 2020-10-31
- CVE: CVE-2020-8551
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/774896
- Library page: https://bugbountylibrary.com/r/h1%3A774896
- Tags: area:cloud domain:cloud impact:dos kind:bounty platform:hackerone sev:medium tech:kubernetes technique:source-review vuln:dos vuln:misconfiguration

**Target:** kubelet HTTPS server on port 10250 and its Prometheus metrics
**Root cause:** The kubelet records the raw request path as a metric label for every request regardless of authentication, so each unique path creates 16 new time series with no cardinality bound.
**Steps:**
1. Send unauthenticated requests to `https://${NODE_IP}:10250/foo`, `/bar`, `/baz` with random paths
2. Observe via `kubectl proxy` then `curl http://127.0.0.1:8001/api/v1/nodes/${NODE_NAME}/proxy/metrics | grep kubelet_http_requests`
3. Each unique path yields 16 new time series across kubelet_http_requests_total, duration histogram, and inflight counter
4. Continue spamming random paths until kubelet memory grows and it is OOM-killed or begins evicting pods
**How found:** Researcher read the kubelet server metrics code and noticed the `path` label is populated from every request before authentication, then tested by sending random paths and watching the metrics endpoint grow.
**Exploitation:** An unauthenticated attacker with network reach to the kubelet port floods it with requests to unique random paths; each path permanently adds 16 metric time series, growing memory until the kubelet is OOM-killed or evicts all workloads.
**Insight:** Metrics endpoints that label by raw request path/URL are cardinality bombs; check whether the label is set pre-auth and whether any allowlist or normalization bounds unique values.