Critical ThreatCloud & Container SecurityCWE-275
Kubernetes RBAC Auditing & Least-Privilege Policies
Secure Kubernetes clusters by auditing RBAC policies, enforcing least privilege, and implementing strict Pod Security Standards.
Vulnerability Overview
Overly permissive RBAC allows lateral movement.
Compromised pods use service accounts to query the API server.
Vulnerable Code
resources: ['*']\nverbs: ['*']Grants cluster admin.
Remediated Code
resources: ['pods']\nverbs: ['get', 'list']Restricts to needed permissions.
Hardening Rules
- 1Audit clusterroles
- 2Disable automountServiceAccountToken
- 3Use Pod Security Admission
Frequently Asked Questions
What is automountServiceAccountToken?
It automatically injects API credentials into every pod. Disable it unless needed.