What is Kubernetes security?

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

What is the CKS certification?

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

What are Kubernetes network policies?

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

What are Pod Security Standards?

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

What is RBAC in Kubernetes?

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

How do I secure etcd in Kubernetes?

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

What is a container escape attack?

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

What tools are used for Kubernetes security scanning?

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

CVE-2023-3676 — Insufficient input sanitization on Windows nodes leads to privilege escalation

HIGH8.8CVE-2023-3676

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Affected projects: kubernetes
Disclosed: July 14, 2023
Last updated: April 30, 2026

Affected versions

Project	Vulnerable range
kubelet	`<= v1.28.0`
kubelet	`<= v1.27.4`
kubelet	`<= v1.26.7`
kubelet	`<= v1.25.12`
kubelet	`<= v1.24.16`

Patched versions

Project	Fixed in
kubelet	`v1.28.1`
kubelet	`v1.27.5`
kubelet	`v1.26.8`
kubelet	`v1.25.13`
kubelet	`v1.24.17`

References

Summary

A security issue was discovered in Kubernetes where a user that can create pods on Windows nodes may be able to escalate to admin privileges on those nodes. Kubernetes clusters are only affected if they include Windows nodes. Run kubectl get nodes -l kubernetes.io/os=windows to determine whether any Windows nodes are present in your cluster. This is the original vulnerability in a class of three related issues; full mitigation requires patches for CVE-2023-3676, CVE-2023-3955, and CVE-2023-3893.

Impact

Any user with permission to create pods on Windows nodes can exploit insufficient input sanitization in the kubelet to achieve admin-level privileges on those nodes. The high CVSS score (8.8) reflects the network-accessible attack vector, low required privileges, and full confidentiality, integrity, and availability impact on affected nodes. Clusters with no Windows nodes are not affected. This vulnerability was the original report in a class of three related issues; CVE-2023-3955 and CVE-2023-3893 are related findings discovered during its remediation.

Detection

Kubernetes audit logs can be used to detect if this vulnerability is being exploited. Pod create events with embedded PowerShell commands are a strong indication of exploitation. ConfigMaps and Secrets that contain embedded PowerShell commands and are mounted into pods are also a strong indication of exploitation. If you find evidence that this vulnerability has been exploited, contact security@kubernetes.io.

Mitigation

Upgrade kubelet to a patched version on all Windows nodes:

v1.28.1 or later (for the 1.28 branch)
v1.27.5 or later (for the 1.27 branch)
v1.26.8 or later (for the 1.26 branch)
v1.25.13 or later (for the 1.25 branch)
v1.24.17 or later (for the 1.24 branch)

To upgrade, refer to the Kubernetes cluster upgrade documentation. There are no known mitigations outside of applying the provided patches. Full mitigation for this class of issues requires applying patches for CVE-2023-3676, CVE-2023-3955, and CVE-2023-3893.

Affected versions

Patched versions

References

Summary​

Impact​

Detection​

Mitigation​

References​

Summary

Impact

Detection

Mitigation

References