Unit 42 discloses an attack technique that impersonates SPIFFE/SPIRE workload identities via cgroup forgery

Unit 42 research shows that an attacker who gains root privileges on a Kubernetes node can forge the Linux cgroup information that SPIRE agents use for workload authentication, tricking the agent into issuing SVIDs for other workloads on the same node to processes controlled by the attacker. The research provides complete manual reproduction steps: first read the target pod's PID and cgroup path, then write the attacker's own shell PID into a forged cgroup.procs, and subsequently successfully retrieve the target workload's JWT SVID and trust bundle via the Workload API.