CVE-2025-81348: Woodpecker K8s Backend Privilege Escalation via Unrestricted ServiceAccount

Vulnerability Key Information Summary Vulnerability Overview Vulnerability Name: Privilege Escalation in Kubernetes Backend via Unrestricted CVE ID: CVE-2025-81348 Severity: High Description: When Woodpecker uses the Kubernetes backend, the pipeline option is passed directly to the pod spec without any validation. Users with Push permission can run arbitrary ServiceAccounts within a namespace. If the ServiceAccount has RBAC permissions, this can lead to secret leakage (database credentials, API keys, TLS certificates) or complete cluster takeover. Affected Scope Affected Package: kubernetes backend Affected Versions: >= 1.0.0, < 3.15.0 Fixed Version: 3.16.0 Affected Users: Any Woodpecker instance where a user has Push permissions and non-privileged ServiceAccounts exist in the pipeline namespace. Remediation 1. Restrict Push Permissions: Grant Push permissions to repositories connected to the Kubernetes backend only to trusted users. 2. Harden Pipeline Namespaces: Ensure that non-privileged ServiceAccounts do not exist in the namespace, or minimize their RBAC permissions. 3. Disable Automatic ServiceAccount Token Mounting: Disable automatic token mounting for ServiceAccounts that should not be used by pipelines. 4. Enforce Admission Policies: Use OPA/Gatekeeper, Kyverno, or ValidatingAdmissionPolicy to reject pipeline pods that set unexpected values. 5. Use Dedicated Isolated Namespaces: Use dedicated isolated namespaces for each organization that do not contain sensitive RBAC bindings. Related References Commit that introduced the vulnerability: Affected Versions: v1.0.0 to v3.15.0 Source Code Locations: - (field ) - (unvalidated assignment to pod spec) POC / Exploit Code The page does not contain any POC code or exploit code blocks.

Goal Reached Thanks to every supporter — we hit 100%!

CVE-2025-81348: Woodpecker K8s Backend Privilege Escalation via Unrestricted ServiceAccount

More from this source