Cloud · 206 days ago
Attackers are exploiting a React Server Components vulnerability (CVE-2025-55182) not just to break out of containers, but to steal Kubernetes service-account tokens. This identity theft lets attackers move beyond the container to access cloud backend infrastructure through legitimate credentials. Unit 42 reports a 282% year-over-year increase in Kubernetes token theft, with 78% of activity targeting the IT sector. The December surge in cloud-service attacks directly links to this vulnerability, showing active exploitation shortly after its disclosure. Standard container hardening misses the real risk: attackers leverage stolen Kubernetes identities to pivot across cloud services, expanding their reach without traditional container escape. This pattern demands urgent attention for any Kubernetes-facing web app using React Server Components, as the blast radius extends from app-layer bugs to cloud infrastructure compromise.
Known exploited · CISA KEV
CVSS 10 CRITICAL: a pre-authentication remote code execution vulnerability exists in React Server Components versions 19.0.0, 19.1.0… Known ransomware campaign use. EPSS 100% (100th percentile).
CISA federal remediation date Dec 12 · date passed
1 source covering this story
Understanding Current Threats to Kubernetes Environments
Unit 42 uncovers escalating Kubernetes attacks, detailing how threat actors exploit identities and critical vulnerabilities to compromise cloud environments.
Part of the PlainSec briefing for 2026-04-07