update pods/ephemeralcontainers
The pods/ephemeralcontainers subresource injects an ephemeral debug container into a running Pod, without recreating it.
The RBAC verb is update even though kubectl may issue a PATCH request.
This does not create a node debug Pod.
kubectl debug node/<name> requires create on pods plus permissive admission controls.
Note:
CVE-2023-2727 and CVE-2023-2728 were policy-bypass issues involving ephemeral containers; they are separate from the ordinary RBAC risk of injecting a debug container into an existing pod.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Update pods/ephemeralcontainers to inject a debug container into an existing running Pod.
The debug container runs in the target Pod context and can access the Pod's mounted volumes, ServiceAccount token, and selected process namespace depending on target/runtime support.
Powerful lateral movement inside privileged Pods.
Not the same as kubectl debug node/<name>, which requires create pods and spawns a separate privileged Pod.
Additional rights needed:
Note:
CVE-2023-2727 and CVE-2023-2728 were admission/policy bypasses involving ephemeral containers.
The base RBAC risk is the ability to inject code into an existing Pod.