Lateral movement

Controller of pods with administrator-like permissions in cluster scope

Risk Level

Hazardous (3)

  • N/A

Compliance Frameworks


Controllers are responsible for pods state using a declaration of pod definition. Pods utilize a service account associated with them to communicate with the Kubernetes API, and that service account is mounted by default to any newly created containers. Orca has detected that the Controller {K8sController} creates pods with a service account which has administrative (all verbs on all resources) privileges in {K8sController.PodSpec.K8sCluster} cluster. An attacker with access to the pod's container can extract the service account token and impersonate to it in order to use its privileged permissions to access Kubernetes API and perform any arbitrary actions on {K8sController.PodSpec.K8sCluster} cluster.
  • Recommended Mitigation

    Consider changing {K8sController}'s role according to the least privilege principle.