Permission Reference
How to use
- →Click any permission row to see attack steps, patch status, and CVE references.
- →Use the escalation paths toggle to focus only on the permissions that lead to privilege escalation.
A CVE reference is background on the mechanism, not a claim that your cluster is affected. Where a fix version actually matters, the entry carries a patch status saying so.
144 entries
| Verb ⇅ | Resource ⇅ | Scope ⇅ | Tier ▲ | Audit ⇅ | Escalation ⇅ | |
|---|---|---|---|---|---|---|
| impersonate | users | cluster | T0 | RequestResponse | 2 paths | ↗ |
| impersonate | groups | cluster | T0 | RequestResponse | 1 path | ↗ |
| impersonate | serviceaccounts | cluster | T0 | RequestResponse | 1 path | ↗ |
| escalate | clusterroles | cluster | T0 | RequestResponse | 2 paths | ↗ |
| bind | clusterroles | cluster | T0 | RequestResponse | 2 paths | ↗ |
| list | secrets | cluster | T0 | RequestResponse | 1 path | ↗ |
| watch | secrets | cluster | T0 | RequestResponse | 1 path | ↗ |
| get | nodes/proxy | cluster | T0 | RequestResponse | 3 paths | ↗ |
| create | mutatingwebhookconfigurations | cluster | T0 | RequestResponse | 1 path | ↗ |
| * | * | cluster | T0 | RequestResponse | ↗ | |
| escalate | roles | namespaced | T1 | RequestResponse | 1 path | ↗ |
| bind | roles | namespaced | T1 | RequestResponse | 1 path | ↗ |
| create | clusterrolebindings | cluster | T1 | RequestResponse | 1 path | ↗ |
| create | rolebindings | namespaced | T1 | RequestResponse | 2 paths | ↗ |
| create | pods | namespaced | T1 | Request | 14 paths | ↗↗↗↗ |
| create | daemonsets | namespaced | T1 | RequestResponse | 1 path | ↗ |
| update | daemonsets | namespaced | T1 | Request | 1 path | ↗ |
| patch | daemonsets | namespaced | T1 | Request | 1 path | ↗ |
| create | deployments | namespaced | T1 | Request | 2 paths | ↗ |
| create | statefulsets | namespaced | T1 | Request | 2 paths | ↗ |
| create | replicasets | namespaced | T1 | Request | 2 paths | ↗ |
| create | replicationcontrollers | namespaced | T1 | Request | 2 paths | ↗ |
| create | jobs | namespaced | T1 | Request | 2 paths | ↗ |
| create | cronjobs | namespaced | T1 | Request | 2 paths | ↗ |
| update | deployments | namespaced | T1 | Request | 1 path | ↗ |
| patch | deployments | namespaced | T1 | Request | 1 path | ↗ |
| update | statefulsets | namespaced | T1 | Request | 1 path | ↗ |
| patch | statefulsets | namespaced | T1 | Request | 1 path | ↗ |
| update | cronjobs | namespaced | T1 | Request | 1 path | ↗ |
| patch | cronjobs | namespaced | T1 | Request | 1 path | ↗ |
| create | pods/exec | namespaced | T1 | RequestResponse | 1 path | ↗ |
| create | pods/attach | namespaced | T1 | RequestResponse | 1 path | ↗ |
| update | pods/ephemeralcontainers | namespaced | T1 | RequestResponse | 1 path | ↗ |
| patch | pods/ephemeralcontainers | namespaced | T1 | RequestResponse | 1 path | ↗ |
| patch | pods | namespaced | T1 | Request | 4 paths | ↗ |
| watch | secrets | namespaced | T1 | RequestResponse | 3 paths | ↗ |
| list | secrets | namespaced | T1 | RequestResponse | 3 paths | ↗ |
| get | secrets | namespaced | T1 | RequestResponse | 3 paths | ↗ |
| patch | secrets | namespaced | T1 | RequestResponse | ↗ | |
| update | secrets | namespaced | T1 | RequestResponse | ↗ | |
| create | secrets | namespaced | T1 | RequestResponse | 2 paths | ↗ |
| create | serviceaccounts/token | namespaced | T1 | RequestResponse | 3 paths | ↗ |
| create | nodes | cluster | T1 | RequestResponse | 2 paths | ↗ |
| get | pods/proxy | namespaced | T1 | Request | 1 path | ↗ |
| patch | nodes | cluster | T1 | RequestResponse | 1 path | ↗ |
| create | validatingwebhookconfigurations | cluster | T1 | RequestResponse | 1 path | ↗ |
| patch | validatingwebhookconfigurations | cluster | T1 | RequestResponse | 2 paths | ↗ |
| create | apiservices | cluster | T1 | RequestResponse | 1 path | ↗ |
| create | customresourcedefinitions | cluster | T1 | Request | 1 path | ↗ |
| create | persistentvolumes | cluster | T1 | Request | 1 path | ↗ |
| create | persistentvolumeclaims | namespaced | T1 | Request | 1 path | ↗ |
| create | namespaces | cluster | T1 | Request | 1 path | ↗ |
| patch | namespaces | cluster | T1 | Request | 1 path | ↗ |
| delete | namespaces | cluster | T1 | Request | ↗ | |
| update | configmaps | namespaced | T1 | RequestResponse | 3 paths | ↗↗ |
| patch | configmaps | namespaced | T1 | RequestResponse | 3 paths | ↗↗ |
| create | configmaps | namespaced | T1 | RequestResponse | 2 paths | ↗↗ |
| create | endpointslices | namespaced | T1 | Request | 1 path | ↗ |
| create | endpoints | namespaced | T1 | Request | 1 path | ↗ |
| create | ingresses | namespaced | T1 | Request | ↗ | |
| create | services | namespaced | T1 | RequestResponse | 1 path | ↗ |
| patch | services | namespaced | T1 | RequestResponse | 1 path | ↗ |
| create | mutatingadmissionpolicies | cluster | T1 | RequestResponse | 1 path | ↗ |
| patch | mutatingwebhookconfigurations | cluster | T1 | RequestResponse | 1 path | ↗ |
| create | pods/binding | namespaced | T1 | Request | 1 path | ↗ |
| patch | clusterrolebindings | cluster | T2 | RequestResponse | 1 path | ↗ |
| patch | rolebindings | namespaced | T2 | RequestResponse | 1 path | ↗ |
| create | clusterroles | cluster | T2 | RequestResponse | 2 paths | ↗ |
| update | clusterroles | cluster | T2 | RequestResponse | 2 paths | ↗ |
| create | roles | namespaced | T2 | RequestResponse | 1 path | ↗ |
| update | deployments/scale | namespaced | T2 | Request | ↗ | |
| update | replicasets | namespaced | T2 | Request | 1 path | ↗ |
| patch | replicasets | namespaced | T2 | Request | 1 path | ↗ |
| update | replicationcontrollers | namespaced | T2 | Request | 1 path | ↗ |
| patch | replicationcontrollers | namespaced | T2 | Request | 1 path | ↗ |
| delete | pods | namespaced | T2 | RequestResponse | 1 path | ↗ |
| create | pods/portforward | namespaced | T2 | Request | 1 path | ↗ |
| patch | serviceaccounts | namespaced | T2 | RequestResponse | 3 paths | ↗ |
| create | serviceaccounts | namespaced | T2 | RequestResponse | 4 paths | ↗ |
| update | pods/status | namespaced | T2 | Request | 1 path | ↗ |
| get | nodes/log | cluster | T2 | Request | 1 path | ↗ |
| delete | mutatingwebhookconfigurations | cluster | T2 | RequestResponse | 1 path | ↗ |
| delete | validatingwebhookconfigurations | cluster | T2 | RequestResponse | 1 path | ↗ |
| create | certificatesigningrequests | cluster | T2 | RequestResponse | 2 paths | ↗ |
| update | certificatesigningrequests/approval | cluster | T2 | RequestResponse | 2 paths | ↗ |
| approve | signers | cluster | T2 | RequestResponse | 2 paths | ↗ |
| delete | customresourcedefinitions | cluster | T2 | Request | 1 path | ↗ |
| create | storageclasses | cluster | T2 | Request | 1 path | ↗ |
| get | configmaps | namespaced | T2 | Request | ↗↗ | |
| create | networkpolicies | namespaced | T2 | RequestResponse | 1 path | ↗ |
| delete | networkpolicies | namespaced | T2 | RequestResponse | 1 path | ↗ |
| get | services/proxy | namespaced | T2 | Request | 1 path | ↗ |
| create | tokenreviews | cluster | T2 | Request | ↗ | |
| create | subjectaccessreviews | cluster | T2 | Request | ↗ | |
| get | nodes | cluster | T2 | Metadata | 1 path | ↗ |
| list | nodes | cluster | T2 | Metadata | 1 path | ↗ |
| update | certificatesigningrequests/status | cluster | T2 | RequestResponse | ↗ | |
| sign | signers | cluster | T2 | RequestResponse | ↗ | |
| create | mutatingadmissionpolicybindings | cluster | T2 | RequestResponse | 2 paths | ↗ |
| create | validatingadmissionpolicies | cluster | T2 | RequestResponse | 1 path | ↗ |
| create | validatingadmissionpolicybindings | cluster | T2 | RequestResponse | 1 path | ↗ |
| create | clustertrustbundles | cluster | T2 | RequestResponse | 1 path | ↗ |
| patch | leases | namespaced | T2 | Request | 1 path | ↗ |
| create | priorityclasses | cluster | T2 | Request | 2 paths | ↗ |
| create | runtimeclasses | cluster | T2 | Request | 1 path | ↗ |
| patch | networkpolicies | namespaced | T2 | RequestResponse | 1 path | ↗ |
| create | deviceclasses | cluster | T2 | Request | ↗ | |
| create | poddisruptionbudgets | namespaced | T2 | Request | 1 path | ↗ |
| update | volumeattachments/status | cluster | T2 | RequestResponse | 1 path | ↗ |
| patch | storageclasses | cluster | T2 | Request | 1 path | ↗ |
| delete | deployments | namespaced | T2 | RequestResponse | ↗ | |
| delete | statefulsets | namespaced | T2 | RequestResponse | ↗ | |
| delete | daemonsets | namespaced | T2 | RequestResponse | ↗ | |
| delete | jobs | namespaced | T2 | RequestResponse | ↗ | |
| delete | cronjobs | namespaced | T2 | RequestResponse | ↗ | |
| delete | replicasets | namespaced | T2 | RequestResponse | ↗ | |
| delete | replicationcontrollers | namespaced | T2 | RequestResponse | ↗ | |
| delete | secrets | namespaced | T2 | RequestResponse | ↗ | |
| delete | configmaps | namespaced | T2 | RequestResponse | 1 path | ↗ |
| update | roles | namespaced | T2 | RequestResponse | 1 path | ↗ |
| create | horizontalpodautoscalers | namespaced | T2 | Request | 1 path | ↗ |
| create | pods/eviction | namespaced | T2 | Request | 1 path | ↗ |
| update | replicasets/scale | namespaced | T2 | Request | ↗ | |
| get | certificatesigningrequests | cluster | T3 | Metadata | 2 paths | ↗ |
| create | selfsubjectaccessreviews | cluster | T3 | None | ↗ | |
| get | pods/log | namespaced | T3 | Metadata | ↗ | |
| get | pods | namespaced | T3 | Metadata | ↗ | |
| list | pods | namespaced | T3 | Metadata | ↗ | |
| list | serviceaccounts | namespaced | T3 | Metadata | ↗ | |
| list | clusterroles | cluster | T3 | Metadata | ↗ | |
| list | clusterrolebindings | cluster | T3 | Metadata | ↗ | |
| list | namespaces | cluster | T3 | Metadata | ↗ | |
| get | services | namespaced | T3 | Metadata | ↗ | |
| list | events | namespaced | T3 | None | ↗ | |
| get | volumeattachments | cluster | T3 | Metadata | ↗ | |
| patch | volumeattachments | cluster | T3 | RequestResponse | ↗ | |
| create | selfsubjectrulesreviews | cluster | T3 | Metadata | ↗ | |
| create | selfsubjectreviews | cluster | T3 | Metadata | ↗ | |
| get | nonResourceURLs:/api,/apis,/openapi*,/version | cluster | T3 | None | ↗ | |
| get | nonResourceURLs:/healthz,/livez,/readyz,/version | cluster | T3 | None | ↗ | |
| get | nonResourceURLs:/metrics | cluster | T3 | Metadata | ↗ | |
| get | nodes/metrics | cluster | T3 | Metadata | ↗ | |
| list | endpoints | cluster | T3 | Metadata | ↗ | |
| list | endpointslices | cluster | T3 | Metadata | ↗ |