疑似 0-day
Detects Kubernetes ClusterRoles that grant GET permission on nodes/proxy resource.
Due to an authorization inconsistency in Kubelet, the nodes/proxy GET permission allows
execution of commands in any container via WebSocket connections to the Kubelet API.
The Kubelet authorizes based on the initial HTTP GET method of WebSocket handshake
rather than the actual operation (exec/run/attach) which should require CREATE permission.
id: k8s-clusterrole-nodes-proxy-rce
info:
name: ClusterRoles with Risky nodes/proxy GET Permissio
...