CertGrid CertGrid
Hands-on Lab·Kubernetes and Cloud Native Security Associate

Privilege Escalation from Pod to Node

The most important idea in the KCSA threat model is that `create pods` is a privilege escalation primitive. This guide grants a ServiceAccount nothing but Pod creation, proves it cannot read Secrets, and then reads one through the node instead - before making the same grant useless with a namespace label.

Kubernetes Threat Model Guide 29 of 42 Advanced

Written against the versions above. The escalation uses `hostPath` with `path: /`, which `baseline` Pod Security forbids. Nothing here is a vulnerability - every step is a documented field used as designed.

The cka5001 cluster: one control plane and 3 schedulable workers, on Cilium.
Server NameIP AddressOSRolesCPURAMHDD
CKA5001192.168.0.41Ubuntu 26.04 LTSControl Plane Node (tainted NoSchedule)2 Core4 GB50 GB
CKA5001-NODE01192.168.0.42Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE02192.168.0.43Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB
CKA5001-NODE03192.168.0.44Ubuntu 26.04 LTSWorker Node2 Core4 GB50 GB

Before you start

  1. A ServiceAccount that may create Pods and may not read Secrets

  2. A victim Secret, mounted by somebody else's Pod

  3. The escalation: one Pod, created as the deployer

  4. What it found on the node

  5. The control that ends it, in one label

Official sources

← All KCSA guides