DEV Community

CVE Reports
CVE Reports

Posted on Originally published at cvereports.com

GHSA-JHJP-4C2Q-XMX4: GHSA-JHJP-4C2Q-XMX4: Falco k8saudit Plugin Ruleset Bypass via initContainers and ephemeralContainers

#security #cve #cybersecurity #ghsa

GHSA-JHJP-4C2Q-XMX4: Falco k8saudit Plugin Ruleset Bypass via initContainers and ephemeralContainers

Vulnerability ID: GHSA-JHJP-4C2Q-XMX4
CVSS Score: 8.1
Published: 2026-09-21

A security feature bypass vulnerability in the Falco k8saudit plugin (and its cloud-specific variants) allowed privileged workloads to run undetected. This bypass occurred because the plugin's default extraction logic and rules only evaluated standard containers, completely omitting initContainers and ephemeralContainers.

TL;DR

The Falco k8saudit plugin failed to parse initContainers and ephemeralContainers, allowing users with pod creation privileges to deploy undetected privileged workloads.

⚠️ Exploit Status: POC

Technical Details

  • CWE ID: CWE-20 / CWE-285
  • Attack Vector: Network (Kubernetes API Server)
  • CVSS Base Score: 8.1 (High)
  • Exploit Status: Proof-of-Concept
  • Impact: Security Bypass / Detection Evasion
  • Remediation: Upgrade k8saudit plugin to v0.18.0

Affected Systems

  • falcosecurity/plugins (k8saudit)
  • falcosecurity/plugins (k8saudit-aks)
  • falcosecurity/plugins (k8saudit-eks)
  • falcosecurity/plugins (k8saudit-gke)
  • falcosecurity/plugins (k8saudit-ovh)
  • falcosecurity/plugins - k8saudit: < v0.18.0 (Fixed in: v0.18.0)
  • falcosecurity/plugins - k8saudit-eks: < v0.12.0 (Fixed in: v0.12.0)
  • falcosecurity/plugins - k8saudit-gke: < v0.9.0 (Fixed in: v0.9.0)
  • falcosecurity/plugins - k8saudit-aks: < v0.6.0 (Fixed in: v0.6.0)
  • falcosecurity/plugins - k8saudit-ovh: < v0.6.0 (Fixed in: v0.6.0)

Code Analysis

Commit: 0adb9b3

Refactor extraction logic to support initContainers and ephemeralContainers in k8saudit.

Exploit Details

  • GitHub: Proof of Concept logic bypass via privileged parameters in initContainers and ephemeralContainers.

Mitigation Strategies

  • Upgrade Falco k8saudit plugin to version v0.18.0 or later.
  • Upgrade cloud-specific wrappers (k8saudit-aks, k8saudit-eks, k8saudit-gke, k8saudit-ovh) to their respective patched versions.
  • Deploy admission controllers (e.g., Kyverno, OPA Gatekeeper) to enforce policy restrictions on initContainers and ephemeralContainers.

Remediation Steps:

  1. Identify active Falco installations and audit the current version of the k8saudit plugin configuration.
  2. Update the plugin version references in helm configurations (e.g., values.yaml) or plugin configuration manifests.
  3. Verify rule definitions are updated to include the 'any_container_privileged' macro definition.
  4. Apply the configuration update and restart the Falco daemonset to load the patched library.
  5. Optionally implement the provided Kyverno policy to enforce safety boundaries at the API Server entrypoint.

References

Read the full report for GHSA-JHJP-4C2Q-XMX4 on our website for more details including interactive diagrams and full exploit analysis.

Top comments (0)