Findings
- Overprivileged ServiceAccounts — more permissions than needed
- Cluster-admin bindings — non-system accounts with full access
- Wildcard permissions — roles with
*verbs or resources - Unused ServiceAccounts — accounts with no associated pods
- Cross-namespace access — broad ClusterRoleBindings
- Secret access — accounts reading secrets outside their namespace
- Privilege escalation — accounts that can create bindings or impersonate
Risk Levels
| Level | Examples |
|---|---|
| Critical | Non-system cluster-admin, wildcard secrets |
| High | Create/modify RBAC, pod exec across namespaces |
| Medium | List secrets in own namespace, broad read access |
| Low | Unused ServiceAccount, default token mounted |