create clusterrolebindings
Escalation prevention limits new bindings to roles you already fully possess, so alone this is T1.
Combined with bind, this is T0, since bind bypasses the escalation check and self-binding straight to cluster-admin becomes trivial.
Clusters frequently misconfigure this combination.
T0 with following verbs:
cluster-admin, with no need to already hold the rights being granted
Creating a ClusterRoleBinding normally fails unless the caller already holds every right in the referenced role, which is RBAC's escalation prevention.
bind on clusterroles waives that check, so a binding to cluster-admin succeeds from a low-privilege account.
- API Group
- rbac.authorization.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
The bind verb bypasses escalation prevention on ClusterRoleBindings
Create a ClusterRoleBinding from cluster-admin to your own identity
You now hold cluster-admin
Additional rights needed:
· both; bind waives the check, create makes the binding
Note:
By design, holding bind on clusterrolebindings intentionally allows self-binding to cluster-admin.
No patch exists.