← Permission ReferenceK8s docs ↗ K8s docs ↗
T1
patch mutatingwebhookconfigurations
Redirects an existing MutatingWebhookConfiguration's endpoint to an attacker-controlled server.
This is stealthier than creating a new webhook, since it inherits the existing rules, namespaceSelectors, and permissions already in place.
- API Group
- admissionregistration.k8s.io
- Scope
- cluster
- Audit Level
- RequestResponse
Escalation Paths
Patch an existing MutatingWebhookConfiguration to replace the clientConfig.url with an attacker-controlled endpoint
All requests matching the webhook's existing rules are now proxied through the attacker server
Capture SA tokens and secrets.
Silently mutate pod specs or block deployments
Additional rights needed:
none