create pods/attach
Attaching to a running container's stdio is an interactive shell in that container, equivalent to pods/exec.
The target may run as root, carry a permissioned ServiceAccount, mount hostPath volumes, or hold cloud credentials in environment variables.
Contextual upgrade to T0:
The reachable pod set includes a privileged, hostPath, hostPID, or hostNetwork pod (node escape to the host), a pod mounting a cluster-privileged ServiceAccount token, or any kube-system pod.
Exec inherits that context and reaches cluster-admin.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Enumerate pods to find one running as root, privileged, or with a powerful SA
Exec or attach into it
Steal the mounted SA token, access the node, or move laterally
If the pod sets shareProcessNamespace, the exec'd container sees every sibling container's processes and /proc, letting the attacker read another container's env vars and in-memory secrets
Additional rights needed: