patch pods/ephemeralcontainers
A debug container injected into a running Pod inherits what that Pod already has: its ServiceAccount token, its volumes, and its host namespaces where the target sets them.
This is the verb kubectl debug actually sends, so patch alone is sufficient and update alone is refused.
This does not create a node debug Pod.
Note:
CVE-2023-2727 and CVE-2023-2728 were policy-bypass issues involving ephemeral containers; they are separate from the ordinary RBAC risk of injecting a debug container into an existing pod.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Update pods/ephemeralcontainers to inject a debug container into an existing running Pod.
The debug container runs in the target Pod context and can access the Pod's mounted volumes, ServiceAccount token, and selected process namespace depending on target/runtime support.
Reaches any process, mount and token inside a privileged Pod already running.
Not the same as kubectl debug node/<name>, which requires create pods and spawns a separate privileged Pod.
Additional rights needed:
Note:
CVE-2023-2727 and CVE-2023-2728 were admission/policy bypasses involving ephemeral containers.
The base RBAC risk is the ability to inject code into an existing Pod.