create pods/exec
Execute arbitrary commands in any running pod.
Target may run as root, carry a permissioned SA, have hostPath mounts, or hold cloud creds in env.
Audit log shows exec create, not the commands run.
Contextual upgrade to T0:
The reachable pod set includes a privileged, hostPath, hostPID, or hostNetwork pod (node escape to the host), a pod mounting a cluster-privileged ServiceAccount token, or any kube-system pod.
Exec inherits that context and reaches cluster-admin.
- API Group
- (core)
- Scope
- namespaced
- Audit Level
- RequestResponse
Escalation Paths
Enumerate pods to find one running as root, privileged, or with a powerful SA
Exec or attach into it
Steal the mounted SA token, access the node, or move laterally
If the pod sets shareProcessNamespace, the exec'd container sees every sibling container's processes and /proc, letting the attacker read another container's env vars and in-memory secrets
Additional rights needed: