kubevious
v1.2.2
2 Service Accounts
3 Workloads
3 Bindings
1 Critical
2 Low
Description
A Helm chart for Kubevious
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
kubevious-parser | default | ❌ | — | 1 | 1 | Critical |
kubevious-backend | default | ❌ | — | 2 | 1 | Low |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 kubevious-parser
Namespace: default | Automount: ❌
🔑 Permissions (1)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole kubevious-parser | / | get · list · watch | Critical | ClusterStructure ClusterWideAccess ClusterWideLogAccess ClusterWideSecretAccess ConfigMapAccess (+15 more) |
⚠️ Potential Abuse (19)
The following security risks were found based on the above permissions:
- Read secrets cluster-wide
- Read secrets in a namespace
- Read pod logs cluster-wide
- Read pod logs in a namespace
- Read ConfigMaps cluster-wide
- Read ConfigMaps in a namespace
- Read events cluster-wide
- Read RBAC configuration cluster-wide
- List Namespaces (Cluster Reconnaissance)
- List ValidatingWebhookConfigurations (Reconnaissance)
- List MutatingWebhookConfigurations (Reconnaissance)
- Read LimitRanges (Namespace Information Disclosure)
- Read ResourceQuotas (Namespace Information Disclosure)
- Read All ResourceQuotas (Cluster-wide Information Disclosure)
- Read ComponentStatuses (Control Plane Reconnaissance)
- Read CSINode Objects (Node & Storage Reconnaissance)
- Read CSIStorageCapacities (Namespace Storage Reconnaissance)
- Watch All Resources in a Namespace (Broad Information Disclosure)
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | kubevious-parser | kubevious | kubevious/parser:1.2.2 |
🤖 kubevious-backend
Namespace: default | Automount: ❌
🔑 Permissions (2)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
ClusterRole kubevious-backend | kubevious.io/changepackages | delete · get · list · watch | Low | |
ClusterRole kubevious-backend | kubevious.io/validationstates | create · delete · get · list · update | Low |
⚠️ Potential Abuse (1)
The following security risks were found based on the above permissions:
📦 Workloads (1)
| Kind | Name | Container | Image |
|---|---|---|---|
| Deployment | kubevious-backend | kubevious | kubevious/backend:1.2.2 |