Kubernetes Pod Security

Kubernetes orchestrates containers at scale, but each pod introduces attack surface through container images, volume mounts, network policies, and RBAC configurations. A single compromised pod can lead to cluster-wide lateral movement.

Verified by Precogs Threat Research

kubernetespodscontainer-escaperbacUpdated: 2026-03-22

Pod Security Risks

Kubernetes pods face risks from privileged containers, hostPath mounts exposing node filesystems, missing network policies allowing lateral movement, overly permissive service accounts, and container escape vulnerabilities in the runtime. Each of these can escalate from a single compromised workload to full cluster compromise.

Container Escape Vectors

Container escape vulnerabilities allow attackers to break out of the container sandbox and access the host node. Common vectors include kernel exploits (dirty pipe, dirty cow), privileged container abuse, /proc and /sys filesystem access, and CAP_SYS_ADMIN capabilities. These turn a web application compromise into infrastructure compromise.

How Precogs AI Secures Pod Workloads

Precogs AI scans the compiled binaries running inside Kubernetes pods, detecting memory corruption vulnerabilities that could enable container escape, hardcoded credentials that could escalate privileges, and unsafe system calls that bypass security policies.

Attack Scenario: Lateral Movement via Kubelet API

Attacker breaches a low-priority pod (e.g., an internal PDF generator component).

The attacker reads the automatically mounted service account token from the filesystem.

The attacker uses the token to query the Kubernetes API Server (`https://kubernetes.default.svc`).

Due to overly broad RBAC permissions (e.g., `cluster-admin` granted to the default service account), the attacker lists all Secrets in the cluster.

The attacker extracts the production database password and uses it to exfiltrate customer data.

Real-World Code Examples

Cluster Takeover via Service Account Tokens

Kubernetes automatically mounts API credentials into `/var/run/secrets/kubernetes.io/serviceaccount/token` for every pod. If a pod is compromised (e.g., via Log4Shell), attackers scrape this token to query the K8s API, potentially moving laterally to access cloud secrets (CWE-522).

VULNERABLE PATTERN

# VULNERABLE: Default service account mounting
# Exposes K8s API credentials to every pod automatically
apiVersion: v1
kind: Pod
metadata:
  name: frontend-webapp
spec:
  containers:
  - name: web
    image: nginx:latest
  # automountServiceAccountToken is true by default!

SECURE FIX

# SAFE: Explicitly disabling token automount for pods that don't need it
apiVersion: v1
kind: Pod
metadata:
  name: frontend-webapp
spec:
  automountServiceAccountToken: false
  containers:
  - name: web
    image: nginx:latest
    securityContext:
      runAsNonRoot: true
      allowPrivilegeEscalation: false

Detection & Prevention Checklist

✓Migrate from PodSecurityPolicies (deprecated) to Pod Security Admission (PSA) enforcing the "Restricted" profile
✓Set `automountServiceAccountToken: false` on all Deployments unless explicitly required
✓Audit RBAC bindings using tools like `KubeHound` or `KubiScan` to detect privilege escalation paths
✓Ensure `allowPrivilegeEscalation: false` and `readOnlyRootFilesystem: true` are set in the Pod Security Context
✓Monitor Kubernetes Audit Logs for unauthorized `secrets/list` API calls

🛡️

How Precogs AI Protects You

Precogs AI scans every binary in Kubernetes pod images for memory corruption, container escape vectors, hardcoded credentials, and privilege escalation paths — securing workloads before deployment.

Start Free Scan

What are the main security risks in Kubernetes pods?

Kubernetes pods face risks from container escape vulnerabilities, privileged container configurations, missing network policies, overly permissive RBAC, and vulnerable binaries in container images. Precogs AI scans pod workloads at the binary level to detect exploitation vectors.

Scan for Kubernetes Pod Security Issues

Precogs AI automatically detects kubernetes pod security vulnerabilities and generates AutoFix PRs.