domains / families / security / auditing-kubernetes-rbac-privilege-escalation

auditing-kubernetes-rbac-privilege-escalation

separate

Finds over-permissive RBAC roles and service-account token abuse paths in a Kubernetes cluster using kubectl auth can-i, rbac-police, kubectl-who-can, and rakkess, tracing which subjects can escalate toward cluster-admin. Use when reviewing who can escalate privileges in a cluster, hunting exploitable RoleBindings during an authorized review, or validating least privilege after an RBAC change. Keywords: RBAC, ClusterRoleBinding, service account token, auth can-i, rbac-police, escalate, bind, impersonate. Do not use for designing and applying hardened RBAC - use implementing-rbac-hardening-for-kubernetes.

When to use

• During an authorized Kubernetes security assessment or cluster penetration test
• After compromising a pod, to determine what its service-account token can reach
• When reviewing RBAC drift before a production go-live
• When validating least-privilege after a platform migration or Helm rollout

When not to use

• designing and applying hardened RBAC

Skill page

Source