Kubernetes RBAC Misconfiguration
Critical · Access Control
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-269
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-269
Definition
Over-broad Roles/ClusterRoleBindings.
Root cause
cluster-admin for workloads/users.
Affected components
- Components in the “Access Control” class
- Application / API handlers
- Supporting libraries
Impact
Secret theft, workload takeover.
Severity
Critical · CVSS 9.0
Safe lab reproduction
lab-k8s-rbac
Detection methodology
RBAC review; kubectl auth can-i.
Evidence examples
- Lab reproduction notes: lab-k8s-rbac
- Request/response excerpts (redacted)
- Detection signal: RBAC review; kubectl auth can-i
Remediation
Least-privilege Roles; separate namespaces.
Secure coding examples
Audit RBAC with tools; policy-as-code.
Related CYNARKS lessons & labs
Tools: kubectl
Practise related skills in Labs or deepen on Academy library.