KUBERNETES REMOTE CODE EXECUTION VIA NODES/PROXY GET PERMISSION

Summary from the TLDR InfoSec newsletter

An authorization bypass in Kubernetes allows service accounts with nodes/proxy GET permissions to execute commands in any Pod across the cluster, potentially leading to full cluster compromise. The vulnerability stems from the Kubelet authorizing WebSocket connections based on the initial HTTP GET handshake rather than verifying CREATE permissions for the /exec endpoint, affecting 69 Helm charts, including Prometheus, Datadog, Grafana, and Cilium. Kubernetes Security Team closed this as "Won't Fix (Working as Intended)," recommending migration to KEP-2862's fine-grained authorization when it reaches GA in April.