What is Kubernetes security?

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

What is the CKS certification?

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

What are Kubernetes network policies?

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

What are Pod Security Standards?

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

What is RBAC in Kubernetes?

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

How do I secure etcd in Kubernetes?

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

What is a container escape attack?

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

What tools are used for Kubernetes security scanning?

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

GHSA-3xfv-vq8x-qhg4 — Policy apiCall urlPath separator injection

CRITICAL9.9GHSA-3xfv-vq8x-qhg4

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected projects: kyverno
Disclosed: October 21, 2026
Last updated: October 23, 2026

Affected versions

Project	Vulnerable range
github.com/kyverno/kyverno	`<= v1.19.1`

Patched versions

Project	Fixed in
github.com/kyverno/kyverno	`1.19.2`

References

GHSA-3xfv-vq8x-qhg4

Summary

A namespace-scoped user who can create a namespaced Policy in their own namespace can set a context.apiCall urlPath that hides ../ segments behind a URL fragment (#) or query (?) separator. Kyverno validates the fully cleaned path against the policy's namespace but executes the raw path; since the Kubernetes client discards fragment and query portions when resolving the URL, the request lands on any namespace or cluster-scoped endpoint the attacker chooses, executed with the admission controller's ServiceAccount. This is an incomplete fix of GHSA-5qq8-67g6-4h2w: the v1.19.1 patch closed the %2e%2e and ..%2f percent-encoded traversal vectors, but not this separator-hidden variant. Credit: Artem Cherezov.

Impact

The Kyverno admission controller's ServiceAccount can create MutatingWebhookConfiguration, ValidatingWebhookConfiguration, and PolicyException objects cluster-wide, which amounts to effective cluster administrator access. The preconditions are: an authenticated namespace-scoped user with create permission on policies.kyverno.io in their own namespace, and the ability to create any resource the policy matches (to trigger admission and fire the apiCall). This vulnerability was verified on Kyverno v1.19.1 installed from the Helm chart 3.9.1 with default values.

Detection

Inspect all namespaced Policy objects for context[].apiCall.urlPath values containing # or ? characters. If the string after # or ? contains /namespaces/, the policy may be exploiting this validator/executor mismatch. Monitor Kyverno admission controller logs for API calls issued to cluster-scoped endpoints (such as /api/v1/nodes, /apis/admissionregistration.k8s.io/v1/mutatingwebhookconfigurations) when the triggering policy is namespace-scoped.

Mitigation

Upgrade Kyverno to version 1.19.2 or later, which closes this separator-injection variant. No workaround was published in the upstream advisory. Until an upgrade is applied, restrict create permission on policies.kyverno.io to fully trusted users and audit existing Policy objects.

References

GHSA-3xfv-vq8x-qhg4 — GitHub Security Advisory

Affected versions

Patched versions

References

Summary​

Impact​

Detection​

Mitigation​

Related Security Guidance​

References​

Summary

Impact

Detection

Mitigation

Related Security Guidance

References