What is Kubernetes security?

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

What is the CKS certification?

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

What are Kubernetes network policies?

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

What are Pod Security Standards?

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

What is RBAC in Kubernetes?

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

How do I secure etcd in Kubernetes?

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

What is a container escape attack?

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

What tools are used for Kubernetes security scanning?

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

GHSA-f96w-622v-rqpq — NamespacedMutatingPolicy cross-namespace write

CRITICAL9.9GHSA-f96w-622v-rqpq

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
Affected projects: kyverno
Disclosed: October 21, 2026
Last updated: October 23, 2026

Affected versions

Project	Vulnerable range
github.com/kyverno/kyverno	`<= 1.19.0`

Patched versions

Project	Fixed in
github.com/kyverno/kyverno	`1.19.2`

References

GHSA-f96w-622v-rqpq

Summary

A namespace-scoped tenant who can create a NamespacedMutatingPolicy can author a targetMatchConstraints.expression CEL program that emits a literal target object naming a resource in another tenant's namespace. Kyverno's background controller re-fetches and mutates that resource using the cluster-wide background-controller ServiceAccount, because the CEL mutate-existing expression path has none of the namespace clamps present on the legacy v1, deleting, and non-expression code paths. This yields cross-namespace privilege escalation and integrity and availability impact against other tenants.

Impact

The background-controller ServiceAccount holds an aggregated ClusterRole with cluster-wide create/update/patch/delete on roles, rolebindings, networkpolicies, ingresses, ingressclasses, configmaps, resourcequotas, limitranges, and resourceclaims. An attacker can patch an existing RoleBinding in a victim namespace to add themselves as a subject, or rewrite an existing Role's rules to grant broad verbs, gaining read/write access in the victim namespace. Additional impact includes corrupting NetworkPolicies to break network isolation, overwriting ConfigMaps to inject configuration, and rewriting ResourceQuotas in other tenants' namespaces.

Detection

Monitor Kyverno background-controller logs for UpdateRequest objects where the target resource namespace does not match the issuing policy's namespace. Review audit logs for mutations on RoleBinding, Role, NetworkPolicy, or ConfigMap objects that were not initiated by an expected operator identity. Inspect existing NamespacedMutatingPolicy objects for use of spec.targetMatchConstraints.expression with mutateExisting: true, particularly expressions that construct target objects with literal namespace fields.

Mitigation

Upgrade Kyverno to version 1.19.2 or later, which adds namespace clamps to the CEL expression code path in the background controller, bringing it to parity with the guarded paths in the deleting controller and legacy v1 mutate-existing handler. If an immediate upgrade is not possible, restrict who can create NamespacedMutatingPolicy objects in multi-tenant environments by tightening RBAC on the namespacedmutatingpolicies.kyverno.io resource.

References

GHSA-f96w-622v-rqpq — GitHub Security Advisory

Affected versions

Patched versions

References

Summary​

Impact​

Detection​

Mitigation​

Related Security Guidance​

References​

Summary

Impact

Detection

Mitigation

Related Security Guidance

References