Study Finds Thousands of Hosts Expose Kubernetes API Port Publicly
ZoomEye scanning shows a notable share of internet-facing servers listening on the Kubernetes API port 6443.
1h agoSource: dev.to1 min read
Kubernetes now serves as the primary control layer for most modern infrastructure, handling workload scheduling, state storage, credential issuance and privileged operations. Its API component, the kube-apiserver, operates as a network service that can be reached wherever routing, firewalls or cloud security groups allow traffic.
A recent ZoomEye scan measured how many internet-exposed hosts answer on TCP port 6443, the default endpoint for the Kubernetes API. The data reveal a sizable number of systems with the port open, indicating exposure but not confirming any unauthenticated or misconfigured instances.
Key points
Kubernetes API server listens on TCP 6443
ZoomEye identified public listeners on that port
Count reflects exposure, not confirmed vulnerability
Freelancers should audit firewall rules for clusters
This item is an original summary written from the source above. It is drafted
with AI assistance and published automatically under our
editorial policy. Facts belong to the original publisher;
if something here is wrong, tell us and we will fix or remove it.