Privileged-pod chain bypassed tenant isolation in anonymized cloud
A regular tenant reached worker-node root on managed Kubernetes v1.25.16+k0s.0; the provider fixed every reported issue.
48
Product
Kubernetes
- Mentions · 7d1
- Mentions · 30d12
- All mentions27
- First seenAug 19, 2026
- Last mentioned3d ago
Timeline
27 articles · newest firstPaper parks AI-agent pod egress in-kernel until a verifier approves
A 98-instruction eBPF hold adds 4.5 ms median per released connection, with 24 microseconds of that in policy.
46
Prioritizing Microservice Requests via Retries
DiffTry repurposes microservice retries as stateless prioritization, reducing rejections from incidental and adversarial overloads.
43
Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-2039460)
An unpatched Config Connector flaw can exfiltrate secrets across Kubernetes namespaces after Google did not substantively respond.
66
Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459)
Researcher discloses an unpatched credential leak in Kubernetes cloud-provider-gcp after Google's deadline passed.
66
Show HN: K10s – A Clickable Kubernetes TUI (Go, Bubble Tea)
Show HN introduces K10s, a clickable Kubernetes terminal UI written in Go with Bubble Tea.
3
Tensorlake npm Package Compromised to Deliver Shai-Hulud Credential-Stealing Worm
Compromised tensorlake npm 0.5.144 delivered the Shai-Hulud worm to steal secrets and spread to other packages.
73
CVE-2026-71895: Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
DolphinScheduler before 3.4.3 lets non-admins retrieve Kubernetes kubeconfig credentials.
66
Can a Cloud-Native Harness Make Agents Reliable Beyond the Desktop?
Kubernetes creators' Stacklok is building Mecatl, an open-source cloud-native harness to run coding agents beyond the desktop.
42
Guarding the gates: Assessing dangerous permissions granted to Kubernetes built-in principals
Datadog found over 3,500 dangerous RBAC grants to Kubernetes built-in principals across 65,000 clusters.
62
Dell CSM Flaws Enable Unauthenticated Admin Access and Root on Kubernetes Nodes
Dell patched six critical Container Storage Modules flaws, including two unauthenticated CVSS 10.0 bugs.
66
Dell asks admins to patch max severity CSM flaws as soon as possible
Dell patched six critical Container Storage Modules flaws that let unauthenticated attackers gain admin control of enterprise storage.
73
Securing the Kubernetes Supply Chain: Introducing WizOS Helm Charts
Wiz releases hardened WizOS Helm charts after finding supply-chain risks in 61 popular chart repositories.
46
Attackers Target Developer Credentials to Expand Supply Chain Intrusions Beyond Source Code
Malicious npm packages, including Mini Shai-Hulud, steal developer and CI/CD cloud credentials during install.
62
New OperTraitors Tool Reveals Dangerous Privilege Escalation Paths in Kubernetes Operators
Palo Alto Networks released OperTraitor to flag Kubernetes operators granted excessive RBAC privileges.
48
OperTraitor Finds Kubernetes Operators With Cluster-Wide Secret Access and Admin Paths
OperTraitor finds Kubernetes operators with excessive RBAC, including IBM CVE-2026-6389 cluster-wide secret access.
61
EU Cyber Resilience Act requirements for containers and Kubernetes
The EU Cyber Resilience Act imposes SBOM, patching, and 24-hour exploit reporting duties on container and Kubernetes products.
44
OperTraitors: How Kubernetes Operators Betray Your Security Posture
Unit 42's OperTraitor flags overprivileged Kubernetes operators and found CVE-2026-6389 in IBM Turbonomic.
61
Containers Are No Longer a Security Boundary
DepthFirst showed CVE-2026-80521, a Linux AF_UNIX use-after-free, can escape containers sharing the host kernel.
66
[kubernetes] CVE-2026-76654: Subpath symlinking on Windows nodes permits NTLM coercion
Kubernetes Windows nodes can be coerced into NTLM authentication via a subPath symlink to an attacker UNC share.
58
[kubernetes] CVE-2026-2270: StatefulSet and ControllerRevision write permissions allow cross-namespace pod creation
A Kubernetes StatefulSet flaw lets namespace-scoped writers create a pod in another namespace.
48
One Compromised Kubernetes Node Can Expose Every Workload Identity Running on It
Unit42 researchers show a root attacker on a Kubernetes node can manipulate cgroups to make the local SPIRE agent issue other workloads' identities.
52
Kubernetes Attack Lets Hackers Steal SPIFFE Workload Identities and Impersonate Applications
Unit 42 detailed a Kubernetes technique where node-root attackers spoof cgroup selectors to steal SPIFFE/SPIRE workload identities and impersonate applications.
45
The Machine With Many Faces: Post-Exploitation Identity Misuse in SPIFFE/SPIRE
Unit 42 demonstrates that root access on a Kubernetes node lets attackers spoof SPIFFE/SPIRE attestation and harvest co-located workloads' SVIDs.
45
Slim Spider Steals Crypto Custody Secrets From Brazilian Financial Institution
CrowdStrike links previously unseen Slim Spider group to crypto custody secret theft at Brazilian financial institutions since March 2026.
75
How to correlate Kubernetes audit logs with container runtime data
Elastic Security Labs shows how to join Kubernetes audit logs with Defend for Containers runtime data to investigate service account abuse and container escapes.
30
Microsoft Tracks MacSync Stealer by Its Behavior, Not Its Domains
Microsoft correlates over 30 rotating domains to track MacSync Stealer, which steals passwords, SSH keys, wallets and AWS credentials.
50
Related CVEs
by mentions- CVE-2026-6389<1%7.8IBM Turbonomic prometurbo agent 8.16.0 through 8.17.6 IBM Turbonomic Application Resource Management grants excessive cluster‑wide permissions, including…
- CVE-2026-2276914%10.0Hard-coded credentials in Dell RecoverPoint for Virtual Machines allow root OS access
- CVE-2021-2155180%7.8Local Privilege Escalation in Dell dbutil_2_3.sys Driver
- CVE-2026-6369210.0Unauthenticated Privilege Escalation in Dell Container Storage Modules (<1.18.0)
- CVE-2026-6368810.0Unauthenticated Credential Theft in Dell Container Storage Modules (CSM) gRPC Server
- Privilege Escalation to Root on Kubernetes Nodes in Dell CSM Operator
- Hard-Coded Credentials in Dell Container Storage Modules (CSM) Authorization, pre-1.18.0
- Template Injection Privilege Escalation in Dell CSM
- Hard-Coded Credentials in Dell Container Storage Modules (CSM) csm-docs
- NTLM coercion via subPath symlink on Windows Kubernetes nodes
Appears with
- Palo Alto Networksvendor · 6
- Unit 42organization · 4
- Googlevendor · 4
- OperTraitorproduct · 3
- Microsoftvendor · 3
- Spooffeproduct · 3
- OperatorHubproduct · 3
- SPIFFEproduct · 3
- IBMvendor · 3
- SPIREproduct · 3
- Helmproduct · 2
- Cortex Cloudproduct · 2
- GitHuborganization · 2
- Datadogvendor · 2
- Kubernetesorganization · 2
- Prometurboproduct · 2
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.