Manage NetworkPolicies cluster-wide

Overview

Field	Value
ID	1071
Name	Manage NetworkPolicies cluster-wide
Risk Category	NetworkManipulation
Risk Level	Critical
Role Type	ClusterRole
API Groups	networking.k8s.io
Resources	networkpolicies
Risky Verb Combinations	[create] · [update] · [patch] · [delete]
Tags	DenialOfService LateralMovement NetworkManipulation NetworkPolicyManagement Tampering

Description

Allows creating, modifying, or deleting NetworkPolicies in any namespace. This can be used to disable network segmentation, allow/deny traffic to sensitive pods, or isolate critical components, leading to information disclosure, lateral movement, or denial of service.

Abuse Scenarios

Create a NetworkPolicy to allow all ingress traffic to pods in a namespace.

kubectl create -n <namespace> -f - <<EOF
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: allow-all-ingress
spec:
  podSelector: {} # Selects all pods in the namespace
  policyTypes:
  - Ingress
  ingress:
  - {} # Allows all ingress
EOF
# Example: kubectl create -n production -f - <<EOF ... EOF

Delete a critical NetworkPolicy, removing network segmentation.

kubectl delete networkpolicy <networkpolicy-name> -n <namespace>
# Example: kubectl delete networkpolicy deny-all-ingress -n default