Description

Controllers are responsible for pods state using a declaration of pod definition. Pods utilize a service account associated with them to communicate with the Kubernetes API, and that service account is mounted by default to any newly created containers. Orca has detected that the Controller {K8sController} creates pods with a service account with either the ""Verb"" or the ""resource"" sections are using a wildcard (""*"") in their role definition. An attacker with access to the pod's container can extract the service account token and impersonate to it in order to gather information about the cluster and potentially gain higher privileges using the service account token.