Kubernetes RBAC: How to Avoid Privilege Escalation

This report describes how the Kubernetes CSR API can be abused for privilege escalation by creating and approving client certificates that impersonate high-privilege system accounts (for example system:kube-controller-manager), enabling attackers to read secrets and escalate to cluster-admin via service account tokens; it also recommends enabling Kubernetes auditing, restricting RBAC for CSR access, and using admission controllers to block risky signers or subjects.