What is Kubernetes security?

Kubernetes security encompasses the practices, tools, and configurations used to protect Kubernetes clusters, workloads, and data. It includes authentication, authorization (RBAC), network policies, pod security standards, secrets management, and runtime security.

What is the CKS certification?

The Certified Kubernetes Security Specialist (CKS) is a CNCF certification that validates expertise in securing Kubernetes clusters. It covers cluster setup and hardening, system hardening, minimizing microservice vulnerabilities, and supply chain security.

What are Kubernetes network policies?

Network policies are Kubernetes resources that control pod-to-pod and pod-to-external traffic. They act as a firewall for your cluster, allowing you to specify which pods can communicate with each other based on labels, namespaces, and ports.

What are Pod Security Standards?

Pod Security Standards (PSS) are predefined security profiles that define different levels of pod security restrictions: Privileged (unrestricted), Baseline (minimally restrictive to prevent known privilege escalations), and Restricted (heavily restricted following security best practices).

What is RBAC in Kubernetes?

Role-Based Access Control (RBAC) is a Kubernetes authorization mechanism that regulates access to resources based on user roles. It uses Role, ClusterRole, RoleBinding, and ClusterRoleBinding resources to define and assign permissions to users and service accounts.

How do I secure etcd in Kubernetes?

Secure etcd by enabling encryption at rest for secrets, using TLS for client-server communication, restricting access to etcd endpoints via firewall rules, enabling authentication, and running regular backups. etcd stores all cluster data including secrets.

What is a container escape attack?

A container escape attack occurs when a process breaks out of container isolation to access the host system or other containers. Common vectors include privileged containers, hostPath mounts, and kernel exploits. Mitigate with Pod Security Standards and seccomp profiles.

What tools are used for Kubernetes security scanning?

Popular Kubernetes security tools include Trivy (vulnerability scanning), Falco (runtime security), kube-bench (CIS benchmarks), OPA Gatekeeper and Kyverno (policy enforcement), Kubescape (security posture), and Cosign (image signing).

GHSA-wr4f-m7x5-g6x7 — Malformed HTTP request crashes Falco

HIGHGHSA-wr4f-m7x5-g6x7

Affected projects: falco
Disclosed: April 19, 2021
Last updated: April 28, 2026

Affected versions

Project	Vulnerable range
Falco	`< 0.18.0`

Patched versions

Project	Fixed in
Falco	`0.18.0`

References

GHSA-wr4f-m7x5-g6x7

Summary

Falco versions before 0.18.0 crash when the Kubernetes audit event web server receives an HTTP request containing malformed JSON data. An attacker with access to the port exposed by Falco's embedded web server can send a single malformed request to crash the process, disabling runtime security monitoring. This vulnerability was identified as FAL-01-003 in the Falco security audit published in 2019.

Impact

Any actor with network access to Falco's Kubernetes audit endpoint port can crash the Falco process by sending a single HTTP request with malformed data, such as a JSON body where the kind field is set to a non-string value. This takes down all Falco rule evaluation and alert generation for the duration of the outage. The precondition is network access to the web server port — no authentication or special privileges are required beyond that.

Detection

No automated detection method specific to this crash is described in the advisory. Monitor the Falco process for unexpected terminations via service health checks or systemd unit state. Inspect HTTP access logs for the Kubernetes audit endpoint to identify malformed request attempts correlated with crash events.

Mitigation

Upgrade Falco to 0.18.0 or later.

Workaround: Users who do not need Kubernetes Audit Event detection can disable the embedded web server in Falco's configuration. A version upgrade is strongly recommended regardless.

References

GHSA-wr4f-m7x5-g6x7 — Falco security advisory

Affected versions

Patched versions

References

Summary​

Impact​

Detection​

Mitigation​

References​

Summary

Impact

Detection

Mitigation

References