OperTraitors: How Kubernetes Operators Betray Your Security Posture

This report presents OperTraitor, an LLM-powered analysis engine that scans Kubernetes operators' RBAC manifests and identifies discrepancies between documented functionality and actual privileges. Using the tool, the authors discovered widespread excessive permissions in OperatorHub, including a high-severity CVE-2026-6389 in IBM's Turbonomic operator that allowed cluster-wide secret access, and flagged similarly risky Datadog operator configurations; the paper details the threat amplification posed by emerging agentic AI operators and provides practical mitigation recommendations to downscope operator service accounts and secure non-human identities.