6443
Summary
- // if you see it open
- The dominant risk is a configuration/exposure pattern, not a single CVE: a kube-apiserver bound to a public IP with --anonymous-auth=true and an overly permissive RBAC binding (e.g. granting system:anonymous or system:unauthenticated list/watch/create on cluster-scoped resources) permits unauthenticated enumeration and, in worst cases, cluster takeover via a privileged pod manifest into kube-system. An unauthenticated GET to /version, /api, or /healthz on 6443 returns build/version banners used for recon fingerprinting. No CVE is tied to port 6443 itself; do not frame the risk as CVE-attributable.
- // common applications
- Kuberneteskube-apiserverk3sOpenShift
- // analyst note
- Treat an open 6443/tcp as a Kubernetes API server by default; check whether it answers unauthenticated /version or /api requests and whether anonymous auth is enabled. The IANA
sun-sr-httpsreservation is genuine but the software is legacy; do not attribute a CVE to the port itself.
About port 6443/tcp.
Port 6443/tcp is registered with IANA as sun-sr-https, described as "Service Registry Default HTTPS Domain," with assignee and contact both listed as Paul Sterk and a registration date of 2006-03; the Reference field is blank, so no RFC is cited. That name comes from the Sun Microsystems (pre-Oracle) Service Registry product — a SOA/UDDI-style registry whose default HTTPS admin domain listened on 6443 — and the identical entry is dual-registered on 6443/udp under the same assignee and date. In current practice, however, 6443/tcp is overwhelmingly the default port of the Kubernetes API server (kube-apiserver). Kubernetes binds 6443 rather than 443 because ports below 1024 require root on Linux while 6443 does not, and on kubeadm-built clusters it is the main (often only) control-plane port exposed; production setups sometimes front it with a load balancer or reverse proxy on 443 that forwards to 6443. For an analyst, 6443 therefore reads primarily as a Kubernetes control-plane signal. It is routinely scanned (Shodan, Censys, masscan) for exposed API servers: a Shadowserver internet-wide scan reported around 2022-05 found roughly 381,645 unique IPs answering an unauthenticated request with HTTP 200, and Shadowserver publishes this as a recurring "Accessible Kubernetes API Server" report, so the exposure pattern is ongoing rather than a one-time count. The dominant risk is a kube-apiserver bound to a public IP with --anonymous-auth=true and an overly permissive RBAC binding (e.g. granting system:anonymous list/watch/create on cluster-scoped resources), which can allow unauthenticated enumeration and, in worst cases, cluster takeover via a privileged pod manifest. No CVE is tied to port 6443 itself — the risk is a configuration/exposure pattern (anonymous auth + public binding + loose RBAC), not a single vulnerability ID, and it should not be framed as CVE-attributable. The legacy Sun/Oracle Service Registry software is effectively end-of-life.
- IANA assignment
sun-sr-https— "Service Registry Default HTTPS Domain"; reference (blank — no RFC cited in IANA registry); assignee/contact Paul Sterk; registration date 2006-03; dual-registered 6443/tcp + 6443/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local copy the IANA Service Name and Transport Protocol Port Number Registry line 10508)- Range class
- registered (1024–49151)
- Prevalence
- routinely scanned as a Kubernetes API port; Shadowserver's ~2022-05 internet scan found ≈381,645 unique IPs returning HTTP 200 to an unauthenticated request, published as a recurring report (do not treat the 2022 figure as a current-day count) [Confirmed for the 2022-05 figure; Likely/Unknown for any live count] — https://www.shadowserver.org/news/over-380-000-open-kubernetes-api-servers/
- Related ports
- 6443/udp (same
sun-sr-httpsregistration; companion reservation); 443/tcp (HTTPS front-end that often proxies to 6443); 8443/tcp (alternative HTTPS); 10250/tcp (kubelet); 2379/2380/tcp (etcd)
Primary use
default port of the Kubernetes API server (kube-apiserver); chosen over 443 because <1024 requires root on Linux, so 6443 is the main control-plane port on kubeadm clusters
Other/unofficial uses
legacy Sun/Oracle Service Registry default HTTPS admin domain (SOA/UDDI-style registry; the origin of the sun-sr-https IANA name; legacy/EOL)
Security implications
exposure pattern, not a single CVE — a kube-apiserver on a public IP with --anonymous-auth=true and loose RBAC (e.g. system:anonymous list/watch/create) permits unauthenticated enumeration and potential cluster takeover; an unauthenticated GET to /version, /api, or /healthz leaks build/version banners for fingerprinting; no CVE is tied to port 6443 itself [Confirmed for the pattern/recon; Unknown for a port-specific CVE] — https://kubernetes.io/docs/concepts/security/controlling-access/
Typically seen on
Kubernetes control-plane nodes (kube-apiserver); legacy Sun/Oracle Service Registry hosts (rare/EOL)
- Analyst note
- Treat an open 6443/tcp as a Kubernetes API server by default; check whether it answers unauthenticated /version or /api requests and whether anonymous auth is enabled. The IANA
sun-sr-httpsreservation is genuine but the software is legacy; do not attribute a CVE to the port itself.
About port 6443/udp.
Port 6443/udp is registered with IANA as sun-sr-https, described as "Service Registry Default HTTPS Domain," with assignee and contact both listed as Paul Sterk and a registration date of 2006-03; the Reference field is blank, so no RFC is cited for this entry. The name comes from the Sun Microsystems (pre-Oracle-acquisition) Service Registry product — a SOA/UDDI-style service registry whose default HTTPS admin domain listened on 6443. The same sun-sr-https name and description are dual-registered on 6443/tcp under the identical assignee and date, so the UDP row exists mostly as a companion reservation rather than a protocol that is actually spoken over UDP. In modern practice the number 6443 is overwhelmingly associated with the Kubernetes API server (kube-apiserver), which defaults to 6443 — but every source consulted specifies that as TCP/HTTPS; kube-apiserver does not serve the API over UDP, and no widely deployed service is documented as using 6443/UDP specifically. For an analyst, that gap matters: the IANA reservation is legitimate but the legacy Sun/Oracle software is effectively end-of-life, and the well-known Kubernetes exposure concerns (an unauthenticated or misconfigured kube-apiserver on 6443 is a high-value cluster-takeover target) apply to 6443/tcp, not to this UDP entry. UDP traffic seen on 6443 in the wild, if any, most plausibly reflects the legacy registration, a locally reassigned service, or unsolicited scan/backscatter — none of which is independently sourced here, so real-world UDP usage and exposure prevalence are left as honest Unknowns rather than borrowing the TCP narrative.
- IANA assignment
sun-sr-https— "Service Registry Default HTTPS Domain"; reference (blank — no RFC cited in IANA registry); assignee/contact Paul Sterk; registration date 2006-03; dual-registered 6443/tcp + 6443/udp [Confirmed] — IANA Service Name and Transport Protocol Port Number Registry (local copy the IANA Service Name and Transport Protocol Port Number Registry line 10509)- Range class
- registered (1024–49151)
- Prevalence
- Unknown — no 6443/udp-specific open-frequency or scan-prevalence statistic found in available sources [Unknown]
- Related ports
- 6443/tcp (same
sun-sr-httpsregistration; the Kubernetes API server default); 8443/tcp (alternative HTTPS)
Primary use
Sun/Oracle Service Registry default HTTPS admin domain (SOA/UDDI-style service registry; legacy/EOL)
Other/unofficial uses
the number 6443 is dominantly the Kubernetes API server today, but that is a TCP-only convention (kube-apiserver does not serve over UDP); no widely deployed 6443/UDP service is documented [Confirmed for the TCP fact; Unknown for real UDP use] — https://kubernetes.io/docs/reference/networking/ports-and-protocols/
Security implications
the well-documented exposure narrative (exposed/unauthenticated kube-apiserver → cluster takeover) applies to 6443/tcp, not this UDP entry; no UDP-6443-specific CVE, malware, or scan statistic was found
Typically seen on
legacy Sun/Oracle Service Registry hosts (rare/EOL); otherwise an anomaly on UDP given the TCP-only modern convention
- Analyst note
- The IANA reservation is genuine but the software is legacy; do not attribute Kubernetes or its exposure risks to the UDP entry — those are TCP. Real-world UDP 6443 usage and exposure prevalence are Unknown.
Service assignments.
| Name | Protocol | Description | Open frequency |
|---|---|---|---|
| sun-sr-https | TCP | Service Registry Default HTTPS Domain | 0.00% |
| sun-sr-https | UDP | Service Registry Default HTTPS Domain | 0.00% |
Service assignments from the IANA Service Name and Transport Protocol Port Number Registry, with open-frequency data from nmap-services.