vcluster-pro-k0s
v0.2.1-alpha.0
2 Service Accounts
1 Workloads
18 Bindings
1 Critical
6 High
2 Medium
9 Low
Description
vcluster-pro - Virtual Kubernetes Clusters (k0s)
Overview
| Identity | Namespace | Automount | Secrets | Permissions | Workloads | Risk |
|---|---|---|---|---|---|---|
vc-vcluster-pro-k0s | default | ❌ | — | 18 | 2 | Critical |
vc-workload-vcluster-pro-k0s | default | ❌ | — | 0 | 0 | — |
Numbers in the last two columns indicate how many bindings or workloads involve each ServiceAccount.
Identities
🤖 vc-vcluster-pro-k0s
Namespace: default | Automount: ❌
🔑 Permissions (18)
| Role | Resource | Verbs | Risk | Tags |
|---|---|---|---|---|
Role vcluster-pro-k0s | core/secrets | create · delete · get · list · patch · update · watch | Critical | CredentialAccess DataExposure InformationDisclosure Persistence PotentialPrivilegeEscalation (+2 more) |
Role vcluster-pro-k0s | core/configmaps | create · delete · get · list · patch · update · watch | High | ConfigMapAccess DataExposure InformationDisclosure PotentialPrivilegeEscalation Tampering |
Role vcluster-pro-k0s | core/endpoints | create · delete · get · list · patch · update · watch | High | DenialOfService NetworkManipulation Tampering TrafficRedirection |
Role vcluster-pro-k0s | core/pods | create · delete · get · list · patch · update · watch | High | LateralMovement Persistence PotentialPrivilegeEscalation Tampering WorkloadExecution |
Role vcluster-pro-k0s | core/pods/attach | create · delete · get · list · patch · update · watch | High | CodeExecution LateralMovement PodAttach PotentialPrivilegeEscalation |
Role vcluster-pro-k0s | core/pods/exec | create · delete · get · list · patch · update · watch | High | CodeExecution LateralMovement PodExec PotentialPrivilegeEscalation |
Role vcluster-pro-k0s | core/services | create · delete · get · list · patch · update · watch | High | DenialOfService NetworkManipulation ServiceExposure Tampering |
Role vcluster-pro-k0s | core/pods/log | get · list · watch | Medium | DataExposure InformationDisclosure LogAccess |
Role vcluster-pro-k0s | core/pods/portforward | create · delete · get · list · patch · update · watch | Medium | LateralMovement NetworkManipulation PodPortForward |
Role vcluster-pro-k0s | apps/deployments | get · list · watch | Low | |
Role vcluster-pro-k0s | core/events | get · list · watch | Low | |
ClusterRole vc-vcluster-pro-k0s-v-default | cluster.loft.sh/features | get · list · watch | Low | |
ClusterRole vc-vcluster-pro-k0s-v-default | storage.loft.sh/features | get · list · watch | Low | |
Role vcluster-pro-k0s | core/persistentvolumeclaims | create · delete · get · list · patch · update · watch | Low | |
Role vcluster-pro-k0s | apps/replicasets | get · list · watch | Low | |
Role vcluster-pro-k0s | apps/statefulsets | get · list · watch | Low | |
ClusterRole vc-vcluster-pro-k0s-v-default | cluster.loft.sh/virtualclusters | get · list · watch | Low | |
ClusterRole vc-vcluster-pro-k0s-v-default | storage.loft.sh/virtualclusters | get · list · watch | Low |
⚠️ Potential Abuse (13)
The following security risks were found based on the above permissions:
- Namespaced pod exec
- Namespaced pod attach
- Namespaced pod port-forward
- Create pods in a namespace
- Update/Patch pods in a namespace
- Read secrets in a namespace
- Modify secrets in a namespace
- Read pod logs in a namespace
- Read ConfigMaps in a namespace
- Modify ConfigMaps in a namespace
- Manage Endpoints or EndpointSlices in a namespace
- Manage Services in a namespace
📦 Workloads (2)
| Kind | Name | Container | Image |
|---|---|---|---|
| StatefulSet | vcluster-pro-k0s | syncer | ghcr.io/loft-sh/vcluster-pro:0.2.1-alpha.0 |
| StatefulSet | vcluster-pro-k0s | vcluster | k0sproject/k0s:v1.26.0-k0s.0 |
🤖 vc-workload-vcluster-pro-k0s
Namespace: default | Automount: ❌
🔑 Permissions (0)
No explicit RBAC bindings.
📦 Workloads (0)
No workloads use this ServiceAccount.