Kubernetes RBAC Privilege Escalation & Container Breakouts (2026 Masterclass)

Originally published on Andrax Pentester by Syed Zada Abrar.

BLUF (Bottom Line Up Front): Kubernetes RBAC (Role-Based Access Control) privilege escalation occurs when an attacker compromises a pod or service account token possessing over-privileged permissions (such as create pods, impersonate, bind, or patch) and uses those permissions to gain cluster-admin rights or escape to the host node.

Quick Technical Overview

In this masterclass, we break down:

1. Initial Token Enumeration: Extracting JWT tokens from /var/run/secrets/kubernetes.io/serviceaccount/token and auditing via kubectl auth can-i.
2. HostPath Mount Breakout: Launching privileged pods with host root directory mounts (/) to escape container namespaces.
3. Secret Theft & Impersonation: Abusing pods/exec, impersonate, and bind verbs to steal cluster-admin tokens.
4. Container Breakout Mechanics: Leveraging /var/run/docker.sock and Linux Kernel capabilities (CAP_SYS_ADMIN).
5. Detection & Defense: Implementing Kubernetes Pod Security Standards (Restricted Profile) and real-time Falco security rules.

---

Python RBAC Security Auditor Snippet

#!/usr/bin/env python3
import subprocess
import json

def audit_cluster_roles():
    cmd = ["kubectl", "get", "clusterrolebindings", "-o", "json"]
    res = subprocess.run(cmd, capture_output=True, text=True)
    if res.returncode == 0:
        data = json.loads(res.stdout)
        for item in data.get("items", []):
            role_ref = item["roleRef"]["name"]
            if role_ref in ["cluster-admin", "admin"]:
                print(f"[CRITICAL] ClusterAdmin binding: {item['metadata']['name']}")

if __name__ == "__main__":
    audit_cluster_roles()

---

Enterprise Falco Detection Rule

- rule: K8s Host Root Volume Mount Created
  desc: Detects creation of a pod mounting the host root filesystem directory /
  condition: >
    kevt and kops and ka.target.resource="pods" and ka.verb="create" and
    ka.req.pod.volumes.hostpath contains "/"
  output: >
    CRITICAL: Suspicious Pod Creation with Host Root Mount
    (user=%ka.user.name pod=%ka.req.pod.name namespace=%ka.target.namespace)
  priority: CRITICAL
  tags: [k8s, rbac, privilege_escalation]

Read the full, step-by-step hands-on tutorial with working manifests and CLI logs here:
👉 Full Masterclass on Andrax Pentester