Description

Provides easy monitoring definitions for Kubernetes services, and deployment and management of Prometheus instances.

Overview

IdentityNamespaceAutomountSecretsPermissionsWorkloadsRiskCVEs
kube-prometheus-grafanadefault—32CriticalExploited KEV 1 15 crit · 136 high
kube-prometheus-kube-state-metricsdefault—321CriticalUnknown
kube-prometheus-operatordefault—202CriticalExploited* KEV 1 7 crit · 116 high
kube-prometheus-prometheusdefault—90Critical—
kube-prometheus-admissiondefault—42LowHigh 5 crit · 110 high
kube-prometheus-alertmanagerdefault—10Low—
kube-prometheus-grafana-testdefault—11Low—
kube-prometheus-prometheus-node-exporterdefault—11LowHigh 5 crit · 98 high

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

kube-prometheus-kube-state-metrics

Namespace: default  |  Automount:

Permissions (32)

RoleResourceVerbsRiskTags
ClusterRole kube-prometheus-kube-state-metricscore/secretslist · watchCriticalClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole kube-prometheus-kube-state-metricscore/configmapslist · watchHighConfigMapAccess DataExposure InformationDisclosure
ClusterRole kube-prometheus-kube-state-metricsadmissionregistration.k8s.io/mutatingwebhookconfigurationslist · watchMediumInformationDisclosure Reconnaissance WebhookReconnaissance
ClusterRole kube-prometheus-kube-state-metricscore/resourcequotaslist · watchMediumInformationDisclosure QuotaTampering Reconnaissance ResourceConfiguration
ClusterRole kube-prometheus-kube-state-metricsadmissionregistration.k8s.io/validatingwebhookconfigurationslist · watchMediumInformationDisclosure Reconnaissance WebhookReconnaissance
ClusterRole kube-prometheus-kube-state-metricscertificates.k8s.io/certificatesigningrequestslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsbatch/cronjobslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsapps/daemonsetslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsextensions/daemonsetslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsapps/deploymentslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsextensions/deploymentslist · watchLow
ClusterRole kube-prometheus-kube-state-metricscore/endpointslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsautoscaling/horizontalpodautoscalerslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsextensions/ingresseslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsnetworking.k8s.io/ingresseslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsbatch/jobslist · watchLow
ClusterRole kube-prometheus-kube-state-metricscore/limitrangeslist · watchLowInformationDisclosure Reconnaissance ResourceConfiguration
ClusterRole kube-prometheus-kube-state-metricscore/namespaceslist · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole kube-prometheus-kube-state-metricsnetworking.k8s.io/networkpolicieslist · watchLow
ClusterRole kube-prometheus-kube-state-metricscore/nodeslist · watchLow
ClusterRole kube-prometheus-kube-state-metricscore/persistentvolumeclaimslist · watchLow
ClusterRole kube-prometheus-kube-state-metricscore/persistentvolumeslist · watchLow
ClusterRole kube-prometheus-kube-state-metricspolicy/poddisruptionbudgetslist · watchLow
ClusterRole kube-prometheus-kube-state-metricscore/podslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsapps/replicasetslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsextensions/replicasetslist · watchLow
ClusterRole kube-prometheus-kube-state-metricscore/replicationcontrollerslist · watchLow
ClusterRole kube-prometheus-kube-state-metricscore/serviceslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsapps/statefulsetslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsstorage.k8s.io/storageclasseslist · watchLow
ClusterRole kube-prometheus-kube-state-metricsstorage.k8s.io/volumeattachmentslist · watchLow
ClusterRole psp-kube-prometheus-kube-state-metricspolicy/podsecuritypolicies (restricted to: kube-prometheus-kube-state-metrics)useLowDeprecatedFeature NodeAccess PodSecurityPolicy PrivilegeEscalation ResourceNameRestricted

Potential Abuse (12)

The following security risks were found based on the above permissions:

Workloads (1)

KindNameContainerImage
Deploymentkube-prometheus-kube-state-metricskube-state-metricsquay.io/coreos/kube-state-metrics:v1.9.7
Unavailable unauthorized

kube-prometheus-operator

Namespace: default  |  Automount:

Permissions (20)

RoleResourceVerbsRiskTags
ClusterRole kube-prometheus-operatorcore/configmaps*CriticalClusterWideAccess ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation (+2 more)
ClusterRole kube-prometheus-operatorapiextensions.k8s.io/customresourcedefinitions*CriticalCRDManipulation ClusterWideAccess PotentialPrivilegeEscalation Tampering WildcardPermission
ClusterRole kube-prometheus-operatorcore/secrets*CriticalClusterWideAccess ClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure (+6 more)
ClusterRole kube-prometheus-operatorapps/statefulsets*CriticalClusterWideAccess Persistence PotentialPrivilegeEscalation PrivilegeEscalation Tampering (+2 more)
ClusterRole kube-prometheus-operatormonitoring.coreos.com/alertmanagers*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatormonitoring.coreos.com/alertmanagers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatormonitoring.coreos.com/podmonitors*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatormonitoring.coreos.com/prometheuses*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatormonitoring.coreos.com/prometheuses/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatormonitoring.coreos.com/prometheusrules*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatormonitoring.coreos.com/servicemonitors*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatormonitoring.coreos.com/thanosrulers*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatormonitoring.coreos.com/thanosrulers/finalizers*HighClusterWideAccess WildcardPermission
ClusterRole kube-prometheus-operatorcore/endpointscreate · delete · get · updateLow
ClusterRole kube-prometheus-operatorcore/namespacesget · list · watchLowClusterStructure InformationDisclosure Reconnaissance
ClusterRole kube-prometheus-operatorcore/nodeslist · watchLow
ClusterRole kube-prometheus-operatorcore/podsdelete · listLow
ClusterRole kube-prometheus-operatorcore/servicescreate · delete · get · updateLow
ClusterRole kube-prometheus-operatorcore/services/finalizerscreate · delete · get · updateLow
ClusterRole kube-prometheus-operator-psppolicy/podsecuritypolicies (restricted to: kube-prometheus-operator)useLowDeprecatedFeature NodeAccess PodSecurityPolicy PrivilegeEscalation ResourceNameRestricted

Potential Abuse (15)

The following security risks were found based on the above permissions:

Workloads (2)

KindNameContainerImage
Deploymentkube-prometheus-operatorkube-prometheusquay.io/coreos/prometheus-operator:v0.38.1
Unavailable unauthorized
Deploymentkube-prometheus-operatortls-proxysquareup/ghostunnel:v1.5.2
Exploited KEV 1 Likely 5 7 critical · 116 high
Top 8 of 227 CVEs
  • CVE-2020-0601 High CVSS 8.1 KEV stdlib fixed in 1.12.16, 1.13.7
  • CVE-2020-1967 High CVSS 7.5 Likely libcrypto1.1 fixed in 1.1.1g-r0
  • CVE-2020-9283 High CVSS 7.5 Likely golang.org/x/crypto fixed in 0.0.0-20200220183623-bac4c82f6975
  • CVE-2021-23840 High CVSS 7.5 Likely libcrypto1.1 fixed in 1.1.1j-r0
  • CVE-2023-45288 High CVSS 7.5 Likely golang.org/x/net fixed in 0.23.0
  • CVE-2021-3450 High CVSS 7.4 Likely libcrypto1.1 fixed in 1.1.1k-r0
  • CVE-2025-68121 Critical CVSS 10.0 stdlib fixed in 1.24.13, 1.25.7, 1.26.0-rc.3
  • CVE-2023-24538 Critical CVSS 9.8 stdlib fixed in 1.19.8, 1.20.3

OS alpine 3.10.3 end of support · fixable: 7 critical, 116 high · scanned 2026-11-07 as docker.io/squareup/ghostunnel:v1.5.2

kube-prometheus-prometheus

Namespace: default  |  Automount:

Permissions (9)

RoleResourceVerbsRiskTags
ClusterRole kube-prometheus-prometheuscore/nodes/proxyget · list · watchCriticalAuthorizationBypass ClusterAdminAccess CodeExecution ElevationOfPrivilege LateralMovement (+1 more)
ClusterRole kube-prometheus-prometheuscore/endpointsget · list · watchLow
ClusterRole kube-prometheus-prometheusextensions/ingressesget · list · watchLow
ClusterRole kube-prometheus-prometheusnetworking.k8s.io/ingressesget · list · watchLow
ClusterRole kube-prometheus-prometheuscore/nodesget · list · watchLow
ClusterRole kube-prometheus-prometheuscore/nodes/metricsget · list · watchLow
ClusterRole kube-prometheus-prometheuscore/podsget · list · watchLow
ClusterRole kube-prometheus-prometheuscore/servicesget · list · watchLow
ClusterRole kube-prometheus-prometheus-psppolicy/podsecuritypolicies (restricted to: kube-prometheus-prometheus)useLowDeprecatedFeature NodeAccess PodSecurityPolicy PrivilegeEscalation ResourceNameRestricted

Potential Abuse (3)

The following security risks were found based on the above permissions:

Workloads (0)

No workloads use this ServiceAccount.

kube-prometheus-grafana

Namespace: default  |  Automount:

Permissions (3)

RoleResourceVerbsRiskTags
ClusterRole kube-prometheus-grafana-clusterrolecore/secretsget · list · watchCriticalClusterWideSecretAccess CredentialAccess DataExposure InformationDisclosure SecretAccess
ClusterRole kube-prometheus-grafana-clusterrolecore/configmapsget · list · watchHighConfigMapAccess DataExposure InformationDisclosure
Role kube-prometheus-grafanaextensions/podsecuritypolicies (restricted to: kube-prometheus-grafana)useLowResourceNameRestricted

Potential Abuse (5)

The following security risks were found based on the above permissions:

Workloads (2)

KindNameContainerImage
Deploymentkube-prometheus-grafanagrafanagrafana/grafana:7.0.3
Exploited KEV 1 Likely 6 15 critical · 136 high
Top 8 of 275 CVEs
  • CVE-2021-39226 High CVSS 9.8 KEV github.com/grafana/grafana fixed in 7.5.11, 8.1.6
  • CVE-2021-3711 Critical CVSS 9.8 Likely libcrypto1.1 fixed in 1.1.1l-r0
  • CVE-2022-37434 Critical CVSS 9.8 Likely zlib fixed in 1.2.11-r4
  • CVE-2021-23840 High CVSS 7.5 Likely libcrypto1.1 fixed in 1.1.1j-r0
  • CVE-2023-45288 High CVSS 7.5 Likely golang.org/x/net fixed in 0.23.0
  • CVE-2021-3450 High CVSS 7.4 Likely libcrypto1.1 fixed in 1.1.1k-r0
  • CVE-2021-3712 High CVSS 7.4 Likely libcrypto1.1 fixed in 1.1.1l-r0
  • CVE-2025-68121 Critical CVSS 10.0 stdlib fixed in 1.24.13, 1.25.7, 1.26.0-rc.3

OS alpine 3.11.6 end of support · fixable: 15 critical, 136 high · scanned 2026-11-07 as docker.io/grafana/grafana:7.0.3

Deploymentkube-prometheus-grafanagrafana-sc-dashboardkiwigrid/k8s-sidecar:0.1.151
High Likely 5 5 critical · 40 high
Top 8 of 72 CVEs

OS alpine 3.11.6 end of support · fixable: 5 critical, 40 high · scanned 2026-11-07 as docker.io/kiwigrid/k8s-sidecar:0.1.151

kube-prometheus-admission

Namespace: default  |  Automount:

Permissions (4)

RoleResourceVerbsRiskTags
ClusterRole kube-prometheus-admissionadmissionregistration.k8s.io/mutatingwebhookconfigurationsget · updateLow
Role kube-prometheus-admissioncore/secretscreate · getLow
ClusterRole kube-prometheus-admissionadmissionregistration.k8s.io/validatingwebhookconfigurationsget · updateLow
ClusterRole kube-prometheus-admissionpolicy/podsecuritypolicies (restricted to: kube-prometheus-admission)useLowDeprecatedFeature NodeAccess PodSecurityPolicy PrivilegeEscalation ResourceNameRestricted

Potential Abuse (2)

The following security risks were found based on the above permissions:

Workloads (2)

KindNameContainerImage
Jobkube-prometheus-admission-createcreatejettech/kube-webhook-certgen:v1.2.1
High Likely 7 5 critical · 110 high
Top 8 of 224 CVEs
  • CVE-2022-1292 High CVSS 9.8 Likely libssl1.1 fixed in 1.1.0l-1~deb9u6
  • CVE-2019-9512 High CVSS 7.5 Likely golang.org/x/net fixed in 0.0.0-20190813141303-74dc4d7220e7
  • CVE-2020-9283 High CVSS 7.5 Likely golang.org/x/crypto fixed in 0.0.0-20200220183623-bac4c82f6975
  • CVE-2021-23840 High CVSS 7.5 Likely libssl1.1 fixed in 1.1.0l-1~deb9u3
  • CVE-2022-0778 High CVSS 7.5 Likely libssl1.1 fixed in 1.1.0l-1~deb9u5
  • CVE-2023-45288 High CVSS 7.5 Likely golang.org/x/net fixed in 0.23.0
  • CVE-2021-3712 High CVSS 7.4 Likely libssl1.1 fixed in 1.1.0l-1~deb9u4
  • CVE-2025-68121 Critical CVSS 10.0 stdlib fixed in 1.24.13, 1.25.7, 1.26.0-rc.3

OS debian 9.12 end of support · fixable: 5 critical, 110 high · scanned 2026-11-07 as docker.io/jettech/kube-webhook-certgen:v1.2.1

Jobkube-prometheus-admission-patchpatchjettech/kube-webhook-certgen:v1.2.1
High Likely 7 5 critical · 110 high
Top 8 of 224 CVEs
  • CVE-2022-1292 High CVSS 9.8 Likely libssl1.1 fixed in 1.1.0l-1~deb9u6
  • CVE-2019-9512 High CVSS 7.5 Likely golang.org/x/net fixed in 0.0.0-20190813141303-74dc4d7220e7
  • CVE-2020-9283 High CVSS 7.5 Likely golang.org/x/crypto fixed in 0.0.0-20200220183623-bac4c82f6975
  • CVE-2021-23840 High CVSS 7.5 Likely libssl1.1 fixed in 1.1.0l-1~deb9u3
  • CVE-2022-0778 High CVSS 7.5 Likely libssl1.1 fixed in 1.1.0l-1~deb9u5
  • CVE-2023-45288 High CVSS 7.5 Likely golang.org/x/net fixed in 0.23.0
  • CVE-2021-3712 High CVSS 7.4 Likely libssl1.1 fixed in 1.1.0l-1~deb9u4
  • CVE-2025-68121 Critical CVSS 10.0 stdlib fixed in 1.24.13, 1.25.7, 1.26.0-rc.3

OS debian 9.12 end of support · fixable: 5 critical, 110 high · scanned 2026-11-07 as docker.io/jettech/kube-webhook-certgen:v1.2.1

kube-prometheus-alertmanager

Namespace: default  |  Automount:

Permissions (1)

RoleResourceVerbsRiskTags
Role kube-prometheus-alertmanagerpolicy/podsecuritypolicies (restricted to: kube-prometheus-alertmanager)useLowResourceNameRestricted

Potential Abuse (1)

The following security risks were found based on the above permissions:

Workloads (0)

No workloads use this ServiceAccount.

kube-prometheus-grafana-test

Namespace: default  |  Automount:

Permissions (1)

RoleResourceVerbsRiskTags
Role kube-prometheus-grafana-testpolicy/podsecuritypolicies (restricted to: kube-prometheus-grafana-test)useLowResourceNameRestricted

Potential Abuse (1)

The following security risks were found based on the above permissions:

Workloads (1)

KindNameContainerImage
Podkube-prometheus-grafana-testkube-prometheus-testbats/bats:v1.1.0
Elevated 1 critical · 0 high
Top 1 of 1 CVEs

OS alpine 3.8.0 end of support · fixable: 1 critical, 0 high · scanned 2026-11-07 as docker.io/bats/bats:v1.1.0

kube-prometheus-prometheus-node-exporter

Namespace: default  |  Automount:

Permissions (1)

RoleResourceVerbsRiskTags
ClusterRole psp-kube-prometheus-prometheus-node-exporterextensions/podsecuritypolicies (restricted to: kube-prometheus-prometheus-node-exporter)useLowDeprecatedFeature NodeAccess PodSecurityPolicy PrivilegeEscalation ResourceNameRestricted

Potential Abuse (2)

The following security risks were found based on the above permissions:

Workloads (1)

KindNameContainerImage
DaemonSetkube-prometheus-prometheus-node-exporternode-exporterquay.io/prometheus/node-exporter:v1.0.0
High Likely 1 5 critical · 98 high
Top 8 of 198 CVEs

fixable: 5 critical, 98 high · scanned 2026-11-07 as quay.io/prometheus/node-exporter:v1.0.0