# Kubescape Scan Report

## Summary

All | Failed | Skipped
--- | --- | ---
65 | 23 | 10

## Details

Severity | Control Name | Failed Resources | All Resources | Risk Score, %
--- | --- | --- | --- | ---
Critical | API server insecure port is enabled | 0 | 1 | 0
Critical | CVE-2022-39328-grafana-auth-bypass | 0 | 0 | 0
Critical | Disable anonymous access to Kubelet service | 0 | 0 | 0
Critical | Enforce Kubelet client TLS authentication | 0 | 0 | 0
High | Applications credentials in configuration files | 0 | 43 | 0
High | CVE-2021-25742-nginx-ingress-snippet-annotation-vulnerability | 0 | 0 | 0
High | CVE-2022-23648-containerd-fs-escape | 0 | 1 | 0
High | CVE-2022-47633-kyverno-signature-bypass | 0 | 0 | 0
High | Forbidden Container Registries | 0 | 19 | 0
High | Host PID/IPC privileges | 0 | 19 | 0
High | HostNetwork access | 0 | 19 | 0
High | HostPath mount | 0 | 19 | 0
High | Insecure capabilities | 0 | 19 | 0
High | Instance Metadata API | 0 | 0 | 0
High | List Kubernetes secrets | 3 | 74 | 4
High | Privileged container | 0 | 19 | 0
High | RBAC enabled | 0 | 1 | 0
High | Resource limits | 7 | 19 | 44
High | Resources CPU limit and request | 0 | 19 | 0
High | Resources memory limit and request | 0 | 19 | 0
High | Workloads with Critical vulnerabilities exposed to external traffic | 0 | 0 | 0
High | Workloads with RCE vulnerabilities exposed to external traffic | 0 | 0 | 0
High | Writable hostPath mount | 0 | 19 | 0
Medium | Access container service account | 1 | 46 | 2
Medium | Allow privilege escalation | 4 | 19 | 30
Medium | Audit logs enabled | 1 | 1 | 100
Medium | Automatic mapping of service account | 4 | 62 | 10
Medium | CVE-2021-25741 - Using symlink for arbitrary host file system access. | 0 | 0 | 0
Medium | CVE-2022-0185-linux-kernel-container-escape | 0 | 1 | 0
Medium | CVE-2022-24348-argocddirtraversal | 0 | 0 | 0
Medium | Cluster internal networking | 1 | 5 | 20
Medium | Cluster-admin binding | 0 | 74 | 0
Medium | Configured liveness probe | 7 | 19 | 44
Medium | Container hostPort | 0 | 19 | 0
Medium | Containers mounting Docker socket | 0 | 19 | 0
Medium | CoreDNS poisoning | 1 | 74 | 1
Medium | Data Destruction | 2 | 74 | 3
Medium | Delete Kubernetes events | 0 | 74 | 0
Medium | Exec into container | 0 | 74 | 0
Medium | Exposed sensitive interfaces | 0 | 0 | 0
Medium | Images from allowed registry | 0 | 19 | 0
Medium | Ingress and Egress blocked | 7 | 19 | 44
Medium | Linux hardening | 7 | 19 | 44
Medium | Malicious admission controller (mutating) | 0 | 0 | 0
Medium | Mount service principal | 0 | 19 | 0
Medium | No impersonation | 0 | 74 | 0
Medium | Non-root containers | 4 | 19 | 30
Medium | Portforwarding privileges | 0 | 74 | 0
Medium | Secret/ETCD encryption enabled | 1 | 1 | 100
Medium | Sudo in container entrypoint | 0 | 19 | 0
Medium | Workloads with excessive amount of vulnerabilities | 0 | 0 | 0
Low | Access Kubernetes dashboard | 0 | 93 | 0
Low | Configured readiness probe | 7 | 19 | 44
Low | Image pull policy on latest tag | 0 | 19 | 0
Low | Immutable container filesystem | 4 | 19 | 30
Low | K8s common labels usage | 5 | 19 | 34
Low | Kubernetes CronJob | 5 | 5 | 100
Low | Label usage for resources | 3 | 19 | 14
Low | Malicious admission controller (validating) | 0 | 0 | 0
Low | Naked PODs | 0 | 31 | 0
Low | Network mapping | 1 | 5 | 20
Low | PSP enabled | 1 | 1 | 100
Low | Pods in default namespace | 2 | 19 | 20
Low | SSH server running inside container | 0 | 1 | 0

## Failed Resources

### Name: kubescape

ApiVersion: v1

Kind: Namespace

Name: kubescape

Namespace:

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Low | Network mapping | C-0049 |
Medium | Cluster internal networking | C-0054 |

### Name: nginx-1

ApiVersion: apps/v1

Kind: Deployment

Name: nginx-1

Namespace: default

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Allow privilege escalation | C-0016 | spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation=false
Medium | Ingress and Egress blocked | C-0030 |
High | Resource limits | C-0009 | spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE
Low | Configured readiness probe | C-0018 | spec.template.spec.containers[0].readinessProbe=YOUR_VALUE
Medium | Non-root containers | C-0013 | spec.template.spec.containers[0].securityContext.runAsNonRoot=true spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation=false
Medium | Automatic mapping of service account | C-0034 | spec.template.spec.automountServiceAccountToken=false
Medium | Linux hardening | C-0055 | spec.template.spec.containers[0].securityContext.seccompProfile=YOUR_VALUE spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE spec.template.spec.containers[0].securityContext.capabilities.drop[0]=YOUR_VALUE
Medium | Configured liveness probe | C-0056 | spec.template.spec.containers[0].livenessProbe=YOUR_VALUE
Low | K8s common labels usage | C-0077 | metadata.labels=YOUR_VALUE spec.template.metadata.labels=YOUR_VALUE
Low | Pods in default namespace | C-0061 | metadata.namespace
Low | Immutable container filesystem | C-0017 | spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

### Name: kubescape-sneeffer-service-account

ApiVersion:

Kind: ServiceAccount

Name: kubescape-sneeffer-service-account

Namespace: default

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Access container service account | C-0053 |

### Name: kubescape-sneeffer-service-account

ApiVersion: v1

Kind: ServiceAccount

Name: kubescape-sneeffer-service-account

Namespace: default

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Automatic mapping of service account | C-0034 | automountServiceAccountToken=false

### Name: nginx

ApiVersion: apps/v1

Kind: Deployment

Name: nginx

Namespace: default

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Allow privilege escalation | C-0016 | spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation=false
Medium | Ingress and Egress blocked | C-0030 |
High | Resource limits | C-0009 | spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE
Low | Configured readiness probe | C-0018 | spec.template.spec.containers[0].readinessProbe=YOUR_VALUE
Medium | Non-root containers | C-0013 | spec.template.spec.containers[0].securityContext.runAsNonRoot=true spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation=false
Medium | Automatic mapping of service account | C-0034 | spec.template.spec.automountServiceAccountToken=false
Medium | Linux hardening | C-0055 | spec.template.spec.containers[0].securityContext.seccompProfile=YOUR_VALUE spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE spec.template.spec.containers[0].securityContext.capabilities.drop[0]=YOUR_VALUE
Medium | Configured liveness probe | C-0056 | spec.template.spec.containers[0].livenessProbe=YOUR_VALUE
Low | K8s common labels usage | C-0077 | metadata.labels=YOUR_VALUE spec.template.metadata.labels=YOUR_VALUE
Low | Pods in default namespace | C-0061 | metadata.namespace
Low | Immutable container filesystem | C-0017 | spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

### Name: kube-apiserver-dwertent

ApiVersion: v1

Kind: Pod

Name: kube-apiserver-dwertent

Namespace: kube-system

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Audit logs enabled | C-0067 | spec.containers[0].command
Low | PSP enabled | C-0068 | spec.containers[0].command[5]
Medium | Secret/ETCD encryption enabled | C-0066 | spec.containers[0].command

### Name: kubescape-sa

ApiVersion:

Kind: ServiceAccount

Name: kubescape-sa

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Data Destruction | C-0007 | relatedObjects[1].rules[1].resources[1] relatedObjects[1].rules[1].verbs[0] relatedObjects[1].rules[1].apiGroups[0] relatedObjects[1].rules[1].apiGroups[1] relatedObjects[0].subjects[0] relatedObjects[0].roleRef.name
High | List Kubernetes secrets | C-0015 | relatedObjects[1].rules[0].resources[0] relatedObjects[1].rules[0].verbs[0] relatedObjects[1].rules[0].verbs[1] relatedObjects[1].rules[0].verbs[3] relatedObjects[1].rules[0].apiGroups[0] relatedObjects[0].subjects[0] relatedObjects[0].roleRef.name

### Name: default

ApiVersion: v1

Kind: ServiceAccount

Name: default

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Automatic mapping of service account | C-0034 | automountServiceAccountToken=false

### Name: kubescape-registry-scan-1809488850697420828

ApiVersion: batch/v1

Kind: CronJob

Name: kubescape-registry-scan-1809488850697420828

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Ingress and Egress blocked | C-0030 |
High | Resource limits | C-0009 | spec.jobTemplate.spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE
Low | Configured readiness probe | C-0018 | spec.jobTemplate.spec.template.spec.containers[0].readinessProbe=YOUR_VALUE
Low | Kubernetes CronJob | C-0026 |
Low | Label usage for resources | C-0076 | spec.jobTemplate.spec.template.metadata.labels=YOUR_VALUE
Medium | Linux hardening | C-0055 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.seccompProfile=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.capabilities.drop[0]=YOUR_VALUE
Medium | Configured liveness probe | C-0056 | spec.jobTemplate.spec.template.spec.containers[0].livenessProbe=YOUR_VALUE
Low | K8s common labels usage | C-0077 | metadata.labels=YOUR_VALUE spec.jobTemplate.spec.template.metadata.labels=YOUR_VALUE

### Name: kubescape-scheduler

ApiVersion: batch/v1

Kind: CronJob

Name: kubescape-scheduler

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Allow privilege escalation | C-0016 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation=false
Medium | Ingress and Egress blocked | C-0030 |
High | Resource limits | C-0009 | spec.jobTemplate.spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE
Low | Configured readiness probe | C-0018 | spec.jobTemplate.spec.template.spec.containers[0].readinessProbe=YOUR_VALUE
Low | Kubernetes CronJob | C-0026 |
Medium | Non-root containers | C-0013 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.runAsNonRoot=true spec.jobTemplate.spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation=false
Medium | Linux hardening | C-0055 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.seccompProfile=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.capabilities.drop[0]=YOUR_VALUE
Medium | Configured liveness probe | C-0056 | spec.jobTemplate.spec.template.spec.containers[0].livenessProbe=YOUR_VALUE
Low | Immutable container filesystem | C-0017 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true

### Name: ks-sa

ApiVersion:

Kind: ServiceAccount

Name: ks-sa

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Data Destruction | C-0007 | relatedObjects[1].rules[1].resources[0] relatedObjects[1].rules[1].verbs[0] relatedObjects[1].rules[1].apiGroups[0] relatedObjects[0].subjects[0] relatedObjects[0].roleRef.name relatedObjects[1].rules[2].resources[1] relatedObjects[1].rules[2].verbs[0] relatedObjects[1].rules[2].apiGroups[0] relatedObjects[0].subjects[0] relatedObjects[0].roleRef.name
Medium | CoreDNS poisoning | C-0037 | relatedObjects[1].rules[2].resources[0] relatedObjects[1].rules[2].verbs[0] relatedObjects[1].rules[2].apiGroups[0] relatedObjects[0].subjects[0] relatedObjects[0].roleRef.name

High

List Kubernetes secrets

C-0015

relatedObjects[1].rules[0].resources[0]

relatedObjects[1].rules[0].verbs[0]

relatedObjects[1].rules[0].verbs[1]

relatedObjects[1].rules[0].apiGroups[0]

relatedObjects[0].subjects[0]

relatedObjects[0].roleRef.name

relatedObjects[1].rules[2].resources[1]

relatedObjects[1].rules[2].verbs[0]

relatedObjects[1].rules[2].apiGroups[0]

relatedObjects[0].subjects[0]

relatedObjects[0].roleRef.name

### Name: ks-scheduled-scan-armobest-1968464821027741247

ApiVersion: batch/v1

Kind: CronJob

Name: ks-scheduled-scan-armobest-1968464821027741247

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Ingress and Egress blocked | C-0030 |
High | Resource limits | C-0009 | spec.jobTemplate.spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE
Low | Configured readiness probe | C-0018 | spec.jobTemplate.spec.template.spec.containers[0].readinessProbe=YOUR_VALUE
Low | Kubernetes CronJob | C-0026 |
Low | Label usage for resources | C-0076 | spec.jobTemplate.spec.template.metadata.labels=YOUR_VALUE
Medium | Linux hardening | C-0055 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.seccompProfile=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.capabilities.drop[0]=YOUR_VALUE
Medium | Configured liveness probe | C-0056 | spec.jobTemplate.spec.template.spec.containers[0].livenessProbe=YOUR_VALUE
Low | K8s common labels usage | C-0077 | metadata.labels=YOUR_VALUE spec.jobTemplate.spec.template.metadata.labels=YOUR_VALUE

### Name: ks-scheduled-scan-cis-v1-23-t1-0-1-70343785476262573

ApiVersion: batch/v1

Kind: CronJob

Name: ks-scheduled-scan-cis-v1-23-t1-0-1-70343785476262573

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Ingress and Egress blocked | C-0030 |
High | Resource limits | C-0009 | spec.jobTemplate.spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE
Low | Configured readiness probe | C-0018 | spec.jobTemplate.spec.template.spec.containers[0].readinessProbe=YOUR_VALUE
Low | Kubernetes CronJob | C-0026 |
Low | Label usage for resources | C-0076 | spec.jobTemplate.spec.template.metadata.labels=YOUR_VALUE
Medium | Linux hardening | C-0055 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.seccompProfile=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.capabilities.drop[0]=YOUR_VALUE
Medium | Configured liveness probe | C-0056 | spec.jobTemplate.spec.template.spec.containers[0].livenessProbe=YOUR_VALUE
Low | K8s common labels usage | C-0077 | metadata.labels=YOUR_VALUE spec.jobTemplate.spec.template.metadata.labels=YOUR_VALUE

### Name: ks-sa

ApiVersion:

Kind: ServiceAccount

Name: ks-sa

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
High | List Kubernetes secrets | C-0015 | relatedObjects[1].rules[0].resources[0] relatedObjects[1].rules[0].verbs[0] relatedObjects[1].rules[0].verbs[1] relatedObjects[1].rules[0].verbs[2] relatedObjects[1].rules[0].apiGroups[0] relatedObjects[0].subjects[0] relatedObjects[0].roleRef.name

### Name: kubevuln-scheduler

ApiVersion: batch/v1

Kind: CronJob

Name: kubevuln-scheduler

Namespace: kubescape

Severity | Name | Docs | Assisted Remediation
--- | --- | --- | ---
Medium | Allow privilege escalation | C-0016 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation=false
Medium | Ingress and Egress blocked | C-0030 |
High | Resource limits | C-0009 | spec.jobTemplate.spec.template.spec.containers[0].resources.limits.cpu=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].resources.limits.memory=YOUR_VALUE
Low | Configured readiness probe | C-0018 | spec.jobTemplate.spec.template.spec.containers[0].readinessProbe=YOUR_VALUE
Low | Kubernetes CronJob | C-0026 |
Medium | Non-root containers | C-0013 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.runAsNonRoot=true spec.jobTemplate.spec.template.spec.containers[0].securityContext.allowPrivilegeEscalation=false
Medium | Linux hardening | C-0055 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.seccompProfile=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.seLinuxOptions=YOUR_VALUE spec.jobTemplate.spec.template.spec.containers[0].securityContext.capabilities.drop[0]=YOUR_VALUE
Medium | Configured liveness probe | C-0056 | spec.jobTemplate.spec.template.spec.containers[0].livenessProbe=YOUR_VALUE
Low | Immutable container filesystem | C-0017 | spec.jobTemplate.spec.template.spec.containers[0].securityContext.readOnlyRootFilesystem=true