Security Rules
A comprehensive list of security rules for Kubernetes RBAC configurations. Each rule identifies potential security risks.
| Rule ID | Category | Name | Risk Level |
|---|---|---|---|
| 1000 | Elevation of Privilege | Cluster-wide pod exec | Critical |
| 1001 | Elevation of Privilege | Namespaced pod exec | High |
| 1002 | Elevation of Privilege | Cluster-wide pod attach | Critical |
| 1003 | Elevation of Privilege | Namespaced pod attach | High |
| 1004 | Information Disclosure | Cluster-wide pod port-forward | High |
| 1005 | Information Disclosure | Namespaced pod port-forward | Medium |
| 1006 | Elevation of Privilege | Create pods cluster-wide | Critical |
| 1007 | Elevation of Privilege | Create pods in a namespace | High |
| 1008 | Elevation of Privilege | Update/Patch pods cluster-wide | Critical |
| 1009 | Elevation of Privilege | Update/Patch pods in a namespace | High |
| 1010 | Information Disclosure | Read secrets cluster-wide | Critical |
| 1011 | Information Disclosure | Read secrets in a namespace | Critical |
| 1012 | Tampering | Modify secrets cluster-wide | Critical |
| 1013 | Tampering | Modify secrets in a namespace | Critical |
| 1014 | Elevation of Privilege | Node proxy access (Kubelet API) | Critical |
| 1015 | Elevation of Privilege | Modify node configuration (labels, taints) | Critical |
| 1016 | Denial of Service | Delete nodes | Critical |
| 1017 | Tampering | Manage PersistentVolumes (cluster-wide storage manipulation) | Critical |
| 1018 | Information Disclosure | Read pod logs cluster-wide | High |
| 1019 | Information Disclosure | Read pod logs in a namespace | Medium |
| 1020 | Elevation of Privilege | Manage ephemeral containers cluster-wide | Critical |
| 1021 | Elevation of Privilege | Manage ephemeral containers in a namespace | High |
| 1022 | Information Disclosure | Read ConfigMaps cluster-wide | High |
| 1023 | Information Disclosure | Read ConfigMaps in a namespace | Medium |
| 1024 | Tampering | Modify ConfigMaps cluster-wide | Critical |
| 1025 | Tampering | Modify ConfigMaps in a namespace | High |
| 1026 | Denial of Service | Delete namespaces | High |
| 1027 | Elevation of Privilege | Manage ClusterRoles (create, update, patch, delete) | Critical |
| 1028 | Elevation of Privilege | Manage ClusterRoleBindings (create, update, patch, delete) | Critical |
| 1029 | Elevation of Privilege | Manage Roles in a namespace (create, update, patch, delete) | High |
| 1030 | Elevation of Privilege | Manage RoleBindings in a namespace (create, update, patch, delete) | High |
| 1031 | Elevation of Privilege | Escalate privileges via ClusterRoles (escalate verb) | Critical |
| 1032 | Elevation of Privilege | Bind ClusterRoles to identities (bind verb) | Critical |
| 1033 | Elevation of Privilege | Manage Deployments cluster-wide (potential for privileged pod execution) | Critical |
| 1034 | Elevation of Privilege | Manage Deployments in a namespace (potential for privileged pod execution) | High |
| 1035 | Elevation of Privilege | Manage DaemonSets cluster-wide (runs on all nodes, high impact) | Critical |
| 1036 | Elevation of Privilege | Manage DaemonSets in a namespace (runs on nodes, high impact) | Critical |
| 1037 | Elevation of Privilege | Manage StatefulSets cluster-wide | Critical |
| 1038 | Elevation of Privilege | Manage StatefulSets in a namespace | High |
| 1039 | Elevation of Privilege | Manage CronJobs cluster-wide (scheduled privileged execution, persistence) | Critical |
| 1040 | Elevation of Privilege | Manage CronJobs in a namespace (scheduled privileged execution, persistence) | High |
| 1041 | Elevation of Privilege | Manage Jobs cluster-wide (one-off privileged execution) | Critical |
| 1042 | Elevation of Privilege | Manage Jobs in a namespace (one-off privileged execution) | High |
| 1043 | Tampering | Manage MutatingWebhookConfigurations | Critical |
| 1044 | Tampering | Manage ValidatingWebhookConfigurations | Critical |
| 1045 | Tampering | Manage CustomResourceDefinitions | Critical |
| 1046 | Tampering | Manage APIServices | Critical |
| 1047 | Spoofing | Create ServiceAccount Tokens | Critical |
| 1048 | Spoofing | Create ServiceAccount Tokens (ClusterRole for any SA in any namespace) | Critical |
| 1049 | Information Disclosure | Create TokenReviews (validate arbitrary tokens) | Medium |
| 1050 | Information Disclosure | Create SubjectAccessReviews (check arbitrary permissions) | Medium |
| 1051 | Information Disclosure | Create LocalSubjectAccessReviews (check permissions in a namespace) | Low |
| 1052 | Elevation of Privilege | Approve CertificateSigningRequests | Critical |
| 1053 | Spoofing | Create CertificateSigningRequests | Medium |
| 1054 | Information Disclosure | Manage (get, list, watch, delete) CertificateSigningRequests | Medium |
| 1055 | Elevation of Privilege | Manage CSIDrivers (potential node compromise) | Critical |
| 1056 | Tampering | Manage StorageClasses | High |
| 1057 | Denial of Service | Evict Pods cluster-wide | Medium |
| 1058 | Denial of Service | Evict Pods in a namespace | Medium |
| 1059 | Elevation of Privilege | Manage RuntimeClasses | Critical |
| 1060 | Elevation of Privilege | Wildcard permission on all resources cluster-wide (Cluster Admin) | Critical |
| 1061 | Elevation of Privilege | Wildcard permission on all resources in a namespace (Namespace Admin) | Critical |
| 1062 | Spoofing | Manage ClusterIssuers (cert-manager.io) | Critical |
| 1063 | Tampering | Manage ArgoCD Applications (argoproj.io) | Critical |
| 1064 | NetworkManipulation | Manage Cilium ClusterwideNetworkPolicies (cilium.io) | Critical |
| 1065 | Information Disclosure | Manage ETCDSnapshotFiles (k3s.cattle.io) | Critical |
| 1066 | Elevation of Privilege | Impersonate users, groups, or service accounts (cluster-wide) | Critical |
| 1067 | Elevation of Privilege | Manage ServiceAccounts cluster-wide | High |
| 1068 | Elevation of Privilege | Manage ServiceAccounts in a namespace | Medium |
| 1069 | Tampering | Patch node status cluster-wide | High |
| 1070 | Information Disclosure | Read events cluster-wide | Medium |
| 1071 | NetworkManipulation | Manage NetworkPolicies cluster-wide | Critical |
| 1072 | NetworkManipulation | Manage NetworkPolicies in a namespace | High |
| 1073 | NetworkManipulation | Manage Endpoints or EndpointSlices cluster-wide | Critical |
| 1074 | NetworkManipulation | Manage Endpoints or EndpointSlices in a namespace | High |
| 1075 | NetworkManipulation | Manage Services cluster-wide | Critical |
| 1076 | NetworkManipulation | Manage Services in a namespace | High |
| 1077 | Information Disclosure | Read RBAC configuration cluster-wide | Medium |
| 1078 | Elevation of Privilege | Use privileged PodSecurityPolicy (deprecated) | Critical |
| 1079 | Denial of Service | Manage PodDisruptionBudgets cluster-wide | Medium |
| 1080 | Tampering | Manage Leases cluster-wide | Critical |
| 1081 | Tampering | Manage Leases in kube-system or kube-node-lease namespace | Critical |
| 1082 | Information Disclosure | List Namespaces (Cluster Reconnaissance) | Low |
| 1083 | Information Disclosure | List ValidatingWebhookConfigurations (Reconnaissance) | Medium |
| 1084 | Information Disclosure | List MutatingWebhookConfigurations (Reconnaissance) | Medium |
| 1085 | Tampering | Create/Update ControllerRevisions (Potential Tampering) | Medium |
| 1086 | Information Disclosure | Create SelfSubjectRulesReviews (Discover Own Permissions) | Low |
| 1087 | Information Disclosure | Read LimitRanges (Namespace Information Disclosure) | Low |
| 1088 | Information Disclosure | Read ResourceQuotas (Namespace Information Disclosure) | Low |
| 1089 | Information Disclosure | Read All ResourceQuotas (Cluster-wide Information Disclosure) | Medium |
| 1090 | Tampering | Update CertificateSigningRequest Status (Tampering/DoS) | Medium |
| 1091 | NetworkManipulation | Manage Ingresses (Namespace Service Exposure/Traffic Redirection) | High |
| 1092 | NetworkManipulation | Manage IngressClasses (Cluster-wide Traffic Control Tampering) | Critical |
| 1093 | Tampering | Update NetworkPolicy Status (Cluster-wide Tampering) | Medium |
| 1094 | Tampering | Update PodDisruptionBudget Status (Namespace Tampering/DoS) | Medium |
| 1095 | Information Disclosure | Read ComponentStatuses (Control Plane Reconnaissance) | Medium |
| 1096 | Denial of Service | Update Deployment Scale (Resource Abuse/DoS) | High |
| 1097 | Denial of Service | Update StatefulSet Scale (Resource Abuse/DoS) | High |
| 1098 | Denial of Service | Manage FlowSchemas (API Server DoS/Manipulation) | Critical |
| 1099 | Denial of Service | Manage PriorityLevelConfigurations (API Server DoS/Manipulation) | Critical |
| 1100 | Information Disclosure | Read CSINode Objects (Node & Storage Reconnaissance) | Medium |
| 1101 | Information Disclosure | Read CSIStorageCapacities (Namespace Storage Reconnaissance) | Low |
| 1102 | Tampering | Manage VolumeAttachments (Cluster-wide Storage/Node Manipulation) | Critical |
| 1103 | Information Disclosure | Watch All Resources in a Namespace (Broad Information Disclosure) | High |
| 1104 | Elevation of Privilege | Node proxy GET RCE via WebSocket | Critical |