Inspektor Gadget Completes Its First Independent Security Audit

Brian Benz

Microsoft

May 08, 2026

The CNCF eBPF observability project Inspektor Gadget has completed its first independent security audit, with results now published for the community to review.

One thing I've learned working with Open Source software over the years is that the projects you can trust most are the ones willing to let someone else test and review. That's what's recently happened with Inspektor Gadget, the open source eBPF tool for Kubernetes observability and Linux host inspection. Inspektor Gadget completed its first independent security audit, and the results tell a good story about the maturity of this CNCF project.

What is Inspektor Gadget?

Inspektor Gadget is a framework and toolkit that uses eBPF technology to collect and inspect data on Kubernetes clusters and Linux hosts. It manages the packaging, deployment, and execution of "gadgets," which are eBPF programs packaged as OCI images. OCI (the Open Container Initiative) is a Linux Foundation project that defines open industry standards for container image formats and runtimes, so the same image can be distributed and run across any compliant tool or registry. If you're running Kubernetes in production and need to understand what's happening inside your cluster, Inspektor Gadget gives you that visibility. Because eBPF programs are loaded into the kernel at runtime to observe syscalls, network activity, and file access safely, your applications keep running unchanged while you get the data you need.

Microsoft engineers Francis Laniel and Mauricio Vasquez are core maintainers on the project, and Microsoft has been a steady contributor to this CNCF project for several years now.

Why a security audit?

Any tool that runs with elevated privileges on your infrastructure needs to earn trust. Inspektor Gadget runs with root-level access on nodes to do its job, so an independent review of its security posture is the responsible thing to do. The Cloud Native Computing Foundation (CNCF) facilitated the engagement through the Open Source Technology Improvement Fund (OSTIF), a nonprofit dedicated to improving the security of open source software. Over the past ten years, OSTIF has managed security engagements that have uncovered more than 800 vulnerabilities across 120 open source projects.

For Microsoft customers, that trust matters in a very practical way. Inspektor Gadget is incorporated into Microsoft Defender for Containers and AKS's Node Problem Detector, and it is also a common troubleshooting tool used by customers and support engineers when they need to understand what is happening inside a cluster. When a project sits this close to production infrastructure, an independent audit is more than a milestone for the maintainers. It gives customers, operators, and support teams a clearer view of the project's security posture and the fixes already available.

Who did the audit?

OSTIF engaged Shielder, an Italian security firm, to perform the assessment, with two Shielder researchers working on the audit in early 2026. Their methodology combined collaborative threat modeling with the Inspektor Gadget maintainers, manual source code review, dynamic testing on dedicated lab environments, static analysis using tools like Semgrep and GoSec, and AI-assisted code review for broader coverage. They set up three separate test environments: a local Linux host deployment, a remote daemon deployment, and a Kubernetes deployment on minikube.

What did they find?

The audit identified three vulnerabilities. None were rated Critical or High severity.

Two Medium severity findings:

Command Injection in ig image build (CVE-2026-24905): The image build process used Makefiles that embedded user-controlled input without proper escaping, creating a command injection vector. This would matter most in CI/CD scenarios building untrusted gadgets. Fixed in release v0.48.1.
Denial of Service via Event Flooding: A malicious container could flood the eBPF ring buffer (which was hard-coded to 256KB) causing the system to silently drop events from other containers. If you're using Inspektor Gadget for security monitoring, this could let an attacker hide their activity. Fixed in release v0.50.1.

One Low severity finding:

Unsanitized ANSI Escape Sequences in columns output mode (CVE-2026-25996): When displaying events in the terminal, Inspektor Gadget didn't sanitize ANSI escape sequences, which could allow a compromised container to inject terminal escape codes into the operator's display. Fixed in release v0.49.1.

All three vulnerabilities now have patches available.

Hardening recommendations

Beyond the specific vulnerabilities, Shielder provided six hardening recommendations. These are the kinds of findings that don't represent immediate exploits but point to areas where the project can reduce its attack surface over time:

Enforce TLS by default on TCP listeners. When the daemon starts a TCP listener without TLS, it just logs a warning and continues in plaintext. The recommendation is to require an explicit opt-out flag instead.
Pin and verify external dependencies in CI/CD. Several build dependencies were downloaded without hash or signature verification. The team has already landed fixes or has pull requests open for most of these.
Implement a Kubernetes namespace blocklist to prevent unintended tracing on sensitive namespaces like kube-system.
Restrict remote clients from enabling host-level tracing through the daemon, or at minimum document the risk.
Automate third-party vulnerability scanning for project dependencies.
Reduce RBAC permissions on the DaemonSet pod, specifically the nodes/proxy GET permission which could be leveraged for privilege escalation if the service account token is compromised.

The Inspektor Gadget team is working through these systematically. Some are already addressed while others will take more time, particularly the RBAC work and the namespace blocklist implementation.

Gadget bypass testing

One part of the audit I found particularly valuable was the gadget bypass testing. The researchers looked at whether a compromised container could perform operations that Inspektor Gadget is supposed to trace without triggering any events. They found six bypass scenarios, ranging from using newer Linux syscalls that certain gadgets don't hook (like openat2 instead of openat) to evasion through io_uring and statically linked libraries.

These findings are characteristic of the cat-and-mouse nature of kernel-level tracing. As Linux evolves, the set of syscalls and mechanisms grows, and tracing tools need to keep up. The Inspektor Gadget team has already fixed some of these and is documenting the inherent limitations that come with the design of eBPF-based tracing.

What this means

For organizations using Inspektor Gadget in production, the actionable step is to update to v0.50.1 or later, which includes fixes for all three reported vulnerabilities. Other than that, the Shielder team's own summary states that "the overall security posture of Inspektor Gadget is adequately mature from both a secure coding and design point of view."

For the open source community, this audit is an example of how the CNCF ecosystem works at its best. A project reaches a level of adoption where independent security review becomes necessary, OSTIF and CNCF coordinate the engagement, qualified researchers do the work, maintainers fix the issues, and everything gets published so users can make informed decisions. That's the open source process working as it should.