If Kubernetes admins don’t have enough to worry about with the upcoming Nginx gateway cutoff, they now may need to rifle through their Helm charts to potentially thwart a dangerous setting.
Security researcher Graham Helton has shared a Kubernetes vulnerability he unearthed that allows some random user, armed with read-only permission, to run arbitrary and even privileged commands on any pod in a cluster.
His trick is to use a service account with permissions for the Kubernetes nodes/proxy GET resource, which is used by dozens of monitoring…
