vcluster-pro-k0s :: RBAC ATLAS

Description

vcluster-pro - Virtual Kubernetes Clusters (k0s)

https://github.com/loft-sh/vcluster

Overview

Identity	Namespace	Automount	Secrets	Permissions	Workloads	Risk
`vc-vcluster-pro-k0s`	default		—	18	2	Critical
`vc-workload-vcluster-pro-k0s`	default		—	0	0	—

Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.

Identities

`vc-vcluster-pro-k0s`

Namespace: default | Automount:

Permissions (18)

Role	Resource	Verbs	Risk	Tags
Role `vcluster-pro-k0s`	core/secrets	create · delete · get · list · patch · update · watch	Critical	CredentialAccess DataExposure InformationDisclosure Persistence PotentialPrivilegeEscalation (+2 more)
Role `vcluster-pro-k0s`	core/configmaps	create · delete · get · list · patch · update · watch	High	ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering
Role `vcluster-pro-k0s`	core/endpoints	create · delete · get · list · patch · update · watch	High	DenialOfService NetworkManipulation Tampering TrafficRedirection
Role `vcluster-pro-k0s`	core/pods	create · delete · get · list · patch · update · watch	High	LateralMovement Persistence PotentialPrivilegeEscalation Tampering WorkloadExecution
Role `vcluster-pro-k0s`	core/pods/attach	create · delete · get · list · patch · update · watch	High	CodeExecution LateralMovement PodAttach PotentialPrivilegeEscalation
Role `vcluster-pro-k0s`	core/pods/exec	create · delete · get · list · patch · update · watch	High	CodeExecution LateralMovement PodExec PotentialPrivilegeEscalation
Role `vcluster-pro-k0s`	core/services	create · delete · get · list · patch · update · watch	High	DenialOfService NetworkManipulation ServiceExposure Tampering
Role `vcluster-pro-k0s`	core/pods/log	get · list · watch	Medium	DataExposure InformationDisclosure LogAccess
Role `vcluster-pro-k0s`	core/pods/portforward	create · delete · get · list · patch · update · watch	Medium	LateralMovement NetworkManipulation PodPortForward
Role `vcluster-pro-k0s`	apps/deployments	get · list · watch	Low
Role `vcluster-pro-k0s`	core/events	get · list · watch	Low
ClusterRole `vc-vcluster-pro-k0s-v-default`	cluster.loft.sh/features	get · list · watch	Low
ClusterRole `vc-vcluster-pro-k0s-v-default`	storage.loft.sh/features	get · list · watch	Low
Role `vcluster-pro-k0s`	core/persistentvolumeclaims	create · delete · get · list · patch · update · watch	Low
Role `vcluster-pro-k0s`	apps/replicasets	get · list · watch	Low
Role `vcluster-pro-k0s`	apps/statefulsets	get · list · watch	Low
ClusterRole `vc-vcluster-pro-k0s-v-default`	cluster.loft.sh/virtualclusters	get · list · watch	Low
ClusterRole `vc-vcluster-pro-k0s-v-default`	storage.loft.sh/virtualclusters	get · list · watch	Low

Potential Abuse (13)

The following security risks were found based on the above permissions:

Workloads (2)

Kind	Name	Container	Image
StatefulSet	vcluster-pro-k0s	syncer	ghcr.io/loft-sh/vcluster-pro:0.2.0 High Likely 3 6 critical · 91 high Top 8 of 220 CVEs CVE-2024-41110 Critical CVSS 10.0 Likely github.com/docker/docker fixed in 23.0.15, 26.1.5, 27.1.1 +1 CVE-2023-45288 High CVSS 7.5 Likely golang.org/x/net fixed in 0.23.0 CVE-2024-6119 High CVSS 7.5 Likely libcrypto3 fixed in 3.1.7-r0 CVE-2025-68121 Critical CVSS 10.0 stdlib fixed in 1.24.13, 1.25.7, 1.26.0-rc.3 CVE-2023-24538 Critical CVSS 9.8 stdlib fixed in 1.19.8, 1.20.3 CVE-2023-24540 Critical CVSS 9.8 stdlib fixed in 1.19.9, 1.20.4 CVE-2024-24790 Critical CVSS 9.8 stdlib fixed in 1.21.11, 1.22.4 CVE-2026-33186 Critical CVSS 9.1 google.golang.org/grpc fixed in 1.79.3 OS alpine 3.18.0 end of support · fixable: 6 critical, 89 high · scanned 2026-11-06 as `ghcr.io/loft-sh/vcluster-pro:0.2.0`
StatefulSet	vcluster-pro-k0s	vcluster	k0sproject/k0s:v1.26.0-k0s.0 Exploited KEV 1 Likely 8 8 critical · 101 high Top 8 of 254 CVEs CVE-2023-44487 High CVSS 7.5 KEV nghttp2-libs fixed in 1.47.0-r2 CVE-2024-41110 Critical CVSS 10.0 Likely github.com/docker/docker fixed in 23.0.15, 26.1.5, 27.1.1 +1 CVE-2023-38545 Critical CVSS 9.8 Likely curl fixed in 8.4.0-r0 CVE-2023-3676 High CVSS 8.8 Likely k8s.io/kubernetes fixed in 1.28.1, 1.27.5, 1.26.8 +2 CVE-2024-21626 High CVSS 8.6 Likely github.com/opencontainers/runc fixed in 1.1.12 CVE-2022-4450 High CVSS 7.5 Likely libcrypto1.1 fixed in 1.1.1t-r0 CVE-2023-38039 High CVSS 7.5 Likely curl fixed in 8.3.0-r0 CVE-2023-45288 High CVSS 7.5 Likely golang.org/x/net fixed in 0.23.0 OS alpine 3.16.3 end of support · fixable: 8 critical, 99 high · scanned 2026-11-06 as `docker.io/k0sproject/k0s:v1.26.0-k0s.0`

`vc-workload-vcluster-pro-k0s`

Namespace: default | Automount:

Permissions (0)

No explicit RBAC bindings.

Workloads (0)

No workloads use this ServiceAccount.

vcluster-pro-k0s

Riskiest combinations