T05 · Unauthorized Access and Privilege Escalation
- Location
scripts/analyzers/secret.py:41- Finding
Namespace-Scoped Analysis Retrieves and Caches Secrets from All Readable Namespaces
- Content
View full analysis
Vulnerability Details
File Location:
scripts/analyzers/secret.py:41-61; related caching behavior inscripts/core/base.py:511-572
Vulnerability Type: Excessive Kubernetes Secret access and sensitive-data retention
Risk Level: HighVulnerable Code
python secrets = self._list_resources_paginated( list_func=v1.list_secret_for_all_namespaces, cache_key="secrets", namespace=namespace, label_selector=label_selector ) # 获取所有Pod以检查Secret使用情况 pods = self._list_resources_paginated( list_func=v1.list_pod_for_all_namespaces, cache_key="pods", namespace="", label_selector="" ) used_secrets = self._get_used_secrets(pods) for secret in secrets: if namespace and secret.metadata.namespace != namespace: continueThe shared pagination helper retains the complete API response objects:
python full_cache_key = f"{cache_key}:{namespace}:{label_selector}" cached = self._get_cached(full_cache_key) if cached is not None: self._logger.debug(f"使用缓存数据: {full_cache_key}") return cached all_items = [] continue_token = None total_count = 0 iteration = 0 max_iterations = PERF_CONFIG["max_iterations"] while iteration < max_iterations: iteration += 1 try: if continue_token: response = list_func( limit=limit, _continue=continue_token, label_selector=label_selector if label_selector else None, _request_timeout=self._timeout ) else: response = list_func( limit=limit, label_selector=label_selector if label_selector else None, _request_timeout=self._timeout ) items = response.items if hasattr(response, 'items') else response if not isinstance(items, list): items = [items] if items else [] ...[truncated 2831 chars]- Remediation
View remediation
Remediation Suggestions
-
When a namespace is supplied, invoke the namespaced Kubernetes API:
python if namespace: list_func = lambda **kwargs: v1.list_namespaced_secret( namespace=namespace, **kwargs ) else: list_func = v1.list_secret_for_all_namespaces -
Avoid caching complete Kubernetes Secret objects. Disable caching for the Secret analyzer or immediately reduce each object to non-sensitive fields such as:
- Name
- Namespace
- Secret type
- Data key names
- Presence or absence of required fields
-
Explicitly discard Secret values after inspection and ensure they are never included in logs, exceptions, reports, or serialized diagnostic results.
-
Split cache storage by sensitivity and prohibit Secret objects from entering the shared global resource cache.
-
Document and provide a minimal Kubernetes RBAC policy. Prefer namespace-specific Roles and RoleBindings over a cluster-wide Secret-list permission.
-
If cluster-wide Secret analysis is explicitly requested, require clear caller confirmation and disclose that Secret objects from all authorized namespaces will be accessed.
-