Skip to content

Back to the catalog

Five Kubernetes Security Gaps Attackers Chain Together
7asecurity.comarticle

Five Kubernetes Security Gaps Attackers Chain Together

7ASecurity breaks down five Kubernetes misconfiguration categories their pentesters repeatedly chain into working attack paths: over-permissive RBAC defaults, exposed API server/dashboard/kubelet, missing network policies, unsafe pod defaults (root/privileged containers, host path mounts), and weak admission control. It uses a concrete audit example from CNCF's KEDA project, where the Helm chart's scaledRefKinds setting defaulted to wildcard get access across API groups and resource types, silently undermining KEDA's own Secret-access restriction, plus references to Linkerd mesh audits and the NSA/CISA Kubernetes Hardening Guide.

TL;DR 7ASecurity details how RBAC, exposed control-plane components, missing network policies, unsafe pod defaults, and weak admission control chain into real Kubernetes attack paths, illustrated with a KEDA Helm chart wildcard-permission finding.
Open original ↗

Organisations named here

  • CIS Benchmark
  • NSA/CISA Kubernetes Hardening Guide

Technologies named here

  • Kubernetes Event Driven Autoscaler
  • kubectl
  • CIS Benchmark scan
  • Linkerd
  • Kubernetes API server/dashboard/kubelet API testing
  • Kubernetes
  • KEDA
  • Helm

Techniques named here

  • RBAC over-permissioning via default Helm chart values
  • Exploiting exposed API server
  • Exploiting exposed kubelet API
  • Lateral movement via missing network policies
  • Container breakout via unsafe pod defaults
  • Bypassing weak or missing admission control

Related in Cloud & Infra