Zombie endpoint receives traffic

Cette page n'est pas encore disponible en français, sa traduction est en cours.
Si vous avez des questions ou des retours sur notre projet de traduction actuel, n'hésitez pas à nous contacter.

Description

A zombie API endpoint is absent from the latest deployed version of a service yet is still receiving traffic due to deployment drift — for example, a forgotten container, a failed rollout, or a legacy environment still running an outdated version. These endpoints are typically unmaintained and unpatched, making them a high-risk attack surface.

Rationale

This finding works by identifying an API endpoint that:

  • received traffic since the latest deployment (with a 24h grace period after deploy)
  • has a version tag that does not appear in the set of latest deployed versions

Deployment Tracking is a prerequisite for detecting Zombie API endpoints.

Remediation

Identify and decommission the legacy deployment still serving this endpoint (e.g. a forgotten container, a stuck rollout, or an outdated staging environment). Ensure all environments are running the latest version of the service so that removed endpoints can no longer receive traffic.