Kubernetes Attack Surface: What Exposed APIs and Misconfigured RBAC Reveal
An attacker compromised 60+ Kubernetes clusters in a single campaign without exploits, zero-days, or CVEs. Entry came through an API server running anonymous authentication. The attacker read existing RBAC bindings and let the cluster's own configuration deliver cluster-admin access. The blast radius of a Kubernetes cluster is determined in the first 5 minutes after any foothold. The API server, RBAC bindings, and service account token automounting define the escape path before a single exploit
🎯 Vulnerability: Web Security Vulnerability
💡 Defense Fix: Implement strict input validation, contextual output encoding, and enforce least-privilege authorization controls.