Posts

A namespace tenant who can create a Policy acts as Kyverno's admission-controller ServiceAccount anywhere in the cluster. Good old %2e%2e bypass.

New day, new way to make an operator send a user its own privileged ServiceAccount token. This time it's HashiCorp's Vault Secrets Operator. The stolen token reads and writes Secrets across every namespace in the cluster, and creates serviceaccounts/token anywhere - which is one hop from full cluster-admin.

A namespace-scoped tenant grants itself cluster-admin on a default Capsule install, two different ways, plus reads any cluster-scoped object a third way. The developers called the report delusional and blocked me. Seven versions later they patched two of the three.

A namespaced attacker creates a Kafka object and reads every Secret in every namespace, by making the Strimzi operator plant a Role and RoleBinding.

Any tenant with create GrafanaDashboard or GrafanaLibraryPanel access can read the Grafana operator's ServiceAccount token, which has effectively cluster-admin privilege. Grafana rated it Medium.