3,028 Hosts on Port 6443: What Public Kubernetes API Servers Reveal About Cluster Control

Port 6443 is the default secure port for the Kubernetes API server. It is the endpoint that accepts kubectl commands, admits workloads, and issues the credentials that every component in a cluster trusts. When it answers from a public address, the control plane of that cluster is on the internet.

ZoomEye data collected on 20 September 2026 shows 3,028 services answering on port 6443. A separate query for the Kubernetes application fingerprint returned 449 hosts. The two numbers describe different things, and the difference is worth understanding before drawing conclusions.

Reading the two counts

Query	Exact count	What it measures
port:6443	3,028	Services answering on the Kubernetes API server default port
app:"Kubernetes"	449	Hosts whose response identifies Kubernetes as the application

Port 6443 is a registered default, not a Kubernetes-only port. Other services can bind it, and a Kubernetes API server can be configured to listen elsewhere. The application query is stricter: it requires the response to carry a recognizable Kubernetes identity, which depends on how the server answers unauthenticated requests.

A Kubernetes API server that is correctly configured returns a 403 for an unauthenticated request to most endpoints. That is a healthy response and also a less distinctive one for fingerprinting. The gap between 3,028 and 449 is partly a measurement artifact and partly a sign that many services on that port cannot be attributed to Kubernetes from the outside.

What an exposed API server means

An API server is not a web application with a login page. It is the interface that controls scheduling, secrets, service accounts and workload admission. Exposure matters for three reasons.

It expands the authentication surface. Every request to the API server is a chance to test a token, a client certificate or a misconfigured anonymous role. Kubernetes ships with anonymous authentication disabled by default in current versions, but older clusters and hand-built configurations vary.

It exposes version information. An unauthenticated request to the version endpoint returns the server version, which tells an attacker which CVEs to try. This is a normal and expected behavior, and it is also a useful reconnaissance signal.

It removes a network boundary. A cluster whose API server is reachable from the internet cannot rely on network position as a control. Every authorization decision has to be correct, because there is no outer layer to catch a mistake.

What the measurement supports

A count of 3,028 reachable services does not mean 3,028 vulnerable clusters. It means 3,028 services that warrant a second look, and it establishes a baseline that can be re-measured.

For an operator, the useful check is to confirm whether the API server is reachable from outside the expected network. If it is, the next questions are whether anonymous authentication is disabled, whether the version is supported, and whether network policy or a firewall restricts which addresses can reach the endpoint. Managed Kubernetes services typically keep the API server behind a provider-controlled endpoint, which is why self-managed clusters are the more common finding.

ZoomEye is useful here because the same query can be run again after a change. A cluster that stops answering on 6443 from the public internet is a measurable improvement, and a fleet-wide query shows whether that change held.

Limitations

Three limits apply to these figures. A reachable port is not a confirmed Kubernetes API server, and version detection is required to know whether a specific cluster is affected by any given CVE. Coverage depends on how a server responds to probes, so clusters behind filtering or with hardened responses may not appear. And the numbers are a snapshot from 20 September 2026; a query run on another day would return different results.

References

• ZoomEye queries port:6443 and app:"Kubernetes", collected 20 September 2026; exact counts 3,028 and 449.
• Kubernetes documentation, API server default secure port 6443 and anonymous authentication defaults.