Manage Services in a namespace

Overview

Field	Value
ID	1076
Name	Manage Services in a namespace
Risk Category	NetworkManipulation
Risk Level	High
Role Type	Role
API Groups	core
Resources	services
Risky Verb Combinations	[create] · [update] · [patch] · [delete]
Tags	DenialOfService NetworkManipulation ServiceExposure Tampering

Description

Permits creating, updating, or deleting Services within a specific namespace. This can lead to unintended exposure of applications, traffic misdirection, or denial of service within that namespace.

Abuse Scenarios

Create a new NodePort Service to expose an internal application in the namespace.

kubectl create -n <namespace> -f - <<EOF
apiVersion: v1
kind: Service
metadata:
  name: exposed-app-nodeport
spec:
  selector:
    app: <internal-app-label>
  ports:
    - protocol: TCP
      port: 80
      targetPort: 8080
  type: NodePort
EOF
# Example: kubectl create -n default -f - <<EOF ... EOF

Delete a critical Service within the namespace, causing unavailability.

kubectl delete service <service-name> -n <namespace>
# Example: kubectl delete service my-web-app -n production