Kubernetes RBAC and ClusterRole Privilege Escalation

Lacey Cochrane@NullVectorX

•updated Jun 9, 2026•3•0•4

Detects the creation or modification of Kubernetes ClusterRoles, ClusterRoleBindings, and RoleBindings, which can be used for privilege escalation within a Kubernetes cluster. The rule specifically flags activities related to 'cluster-admin' roles as critical and other administrative roles as high severity.