Lack of RBAC

Role-Based Access Control (RBAC) in Kubernetes is a security feature that governs access to resources within a cluster based on predefined roles and permissions. RBAC allows to define granular access policies, specifying which users or entities have the authority to perform certain operations on specific resources. RBAC can enforce the principle of least privilege.

Remediation

Apply granular RBAC.

Metadata

Severity: medium
Slug: lack-of-rbac

CWEs

272: Least Privilege Violation
269: Improper Privilege Management

OWASP

A04:2021: Insecure Design
A05:2021: Security Misconfiguration

Available Labs

Open Kubernetes labs in SecDim Play for this vulnerability.

easy

Rbac.k8s

Other Easy Kubernetes Signature

Play AppSec WarGames

Want to skill-up in secure coding and AppSec? Try SecDim Wargames to learn how to find, hack and fix security vulnerabilities inspired by real-world incidents.

For Companies Play Now

Got a comment?

Join our secure coding and AppSec community. A discussion board to share and discuss all aspects of secure programming, AppSec, DevSecOps, fuzzing, cloudsec, AIsec code review, and more.