Kubernetes: abusing RBAC and service accounts

In Kubernetes every pod has a service account with a token mounted inside. If its RBAC permissions are broad, whoever compromises the pod inherits that power over the API server.

The typical escalations

create pods: create a pod that mounts the node filesystem or runs privileged, and break out to the node. get secrets: read the namespace's secrets (DB creds, keys). bind/escalate: grant yourself roles. SA tokens: if you can create them, impersonate privileged accounts.

kubectl auth can-i --list   # what the current SA can do
kubectl get secrets -A       # if allowed, credentials everywhere

Defence

Least-privilege RBAC, no cluster-admin for workloads. Do not mount the SA token where unneeded (automountServiceAccountToken: false). Pod Security Standards (restricted), network policies, and RoleBinding audits. Tools like kubiscan/rbac-tool to find excesses.