Guarding the gates: Assessing dangerous permissions granted to Kubernetes built-in principals

Using a dataset of over 65,000 Kubernetes clusters from ~10,000 organizations, the analysis examines bindings to built-in principals (`system:anonymous`, `system:unauthenticated`, `system:authenticated`), filters out defaults and deprecated PodSecurityPolicy bindings, and identifies roughly 55,000 non-default bindings with over 3,500 that grant at least one RBAC permission classified as "dangerous"; the report highlights distribution-specific defaults (AKS/EKS/GKE), the risk of namespace-scoped bindings, redundant/poorly maintained RBAC, and recommends auditing and tightening authorization.