What is Kubernetes security?

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

What is the CKS certification?

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

What are Kubernetes network policies?

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

What are Pod Security Standards?

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

What is RBAC in Kubernetes?

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

How do I secure etcd in Kubernetes?

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

What is a container escape attack?

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

What tools are used for Kubernetes security scanning?

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

CVE-2026-41520 — Cilium bugtool leaks WireGuard private key

HIGH7.9CVE-2026-41520GHSA-gj49-89wh-h4gj

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N
Affected projects: cilium
Disclosed: April 22, 2026
Last updated: April 27, 2026

Affected versions

Project	Vulnerable range
cilium-bugtool	`< 1.17.15`
cilium-bugtool	`>= 1.18.0, < 1.18.9`
cilium-bugtool	`>= 1.19.0, < 1.19.3`

Patched versions

Project	Fixed in
cilium-bugtool	`1.17.15`
cilium-bugtool	`1.18.9`
cilium-bugtool	`1.19.3`

References

GHSA-gj49-89wh-h4gj

Summary

The output of cilium-bugtool can contain sensitive data when the tool is run against Cilium deployments with WireGuard encryption enabled. The sensitive data is the WireGuard private key (cilium_wg0.key) used for node-to-node encrypted communication. Users of WireGuard Transparent Encryption are affected.

Impact

cilium-bugtool is a debugging tool typically invoked manually — it does not run during the normal operation of a Cilium cluster — and is also invoked when gathering sysdumps via the Cilium CLI's cilium sysdump command. Any bugtool or sysdump archive collected from a WireGuard-enabled cluster on an affected version may contain the node's WireGuard private key. An attacker with access to such an archive can decrypt or impersonate node-to-node WireGuard traffic for the affected node.

Detection

Audit any previously-shared bugtool or sysdump archives from WireGuard-enabled nodes for the presence of cilium_wg0.key. Treat archives uploaded to ticket systems, shared cloud storage, or distributed for support purposes as potentially compromised. Cluster operators should also confirm whether WireGuard transparent encryption is enabled (kubectl -n kube-system get configmap cilium-config -o yaml | grep encryption).

Mitigation

Upgrade to a patched version on the appropriate release line:

Cilium v1.19.3 or later (for the 1.19 line)
Cilium v1.18.9 or later (for the 1.18 line)
Cilium v1.17.15 or later (for the 1.17 line and earlier)

There is no workaround for the underlying issue. Users who have previously shared bugtool or sysdump archives from WireGuard-enabled nodes should rotate the WireGuard keys on the affected nodes. This can be done by deleting the key file and restarting the Cilium agent, which will generate a new key pair.

Affected versions

Patched versions

References

Summary​

Impact​

Detection​

Mitigation​

References​

Summary

Impact

Detection

Mitigation

References