Privilege Escalation from Node/Proxy Rights in Kubernetes RBAC

This research post demonstrates that granting Kubernetes node/proxy RBAC rights can be abused to reach the Kubelet API (through the API server proxy or directly), enabling attackers with those rights to execute commands in pods as root and to bypass Kubernetes auditing and admission controls; the authors provide a PoC RBAC/ServiceAccount configuration and recommend restricting node/proxy permissions, firewalling Kubelet access, and monitoring for direct Kubelet usage.