Manage RoleBindings in a namespace (create, update, patch, delete)

Overview

Field	Value
ID	1030
Name	Manage RoleBindings in a namespace (create, update, patch, delete)
Risk Category	Elevation of Privilege
Risk Level	High
Role Type	Role
API Groups	rbac.authorization.k8s.io
Resources	rolebindings
Verbs	create, update, patch, delete
Tags	BindingToPrivilegedRole PrivilegeEscalation RBACManipulation

Description

Allows creating, modifying, or deleting RoleBindings within a specific namespace. This enables an attacker to bind users, groups, or service accounts to Roles within that namespace. If a powerful ClusterRole is bound to a service account in the namespace, this can lead to privilege escalation.

Abuse Scenarios

Create a RoleBinding to grant a service account full namespace admin.

kubectl create -n <namespace> -f - <<EOF
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: pwned-namespace-admin-binding
subjects:
- kind: ServiceAccount
  name: <serviceaccount-name>
  namespace: <namespace>
roleRef:
  kind: Role
  name: pwned-namespace-admin # Assuming 'pwned-namespace-admin' role exists
  apiGroup: rbac.authorization.k8s.io
EOF
# Example: kubectl create -n default -f - <<EOF ... EOF (bind 'default' SA to 'pwned-namespace-admin' role)

Delete an existing RoleBinding, revoking namespaced permissions.

kubectl delete rolebinding <rolebinding-name> -n <namespace>
# Example: kubectl delete rolebinding my-app-reader-binding -n production