| CCC.K8S.TH01 | Kubernetes API is Exposed to Untrusted Networks | An API endpoint without network restrictions may be reached from untrusted networks. Cluster resources and configuration can then be enumerated or modified through exposed administrative interfaces. Cluster data may be disclosed, configuration integrity may be lost, and workloads may be disrupted. | 2 | 1 | 1 |
| CCC.K8S.TH02 | Workload Identity Grants Excessive Cloud Access | A Kubernetes service account bound to an overprivileged cloud identity may give its workloads permissions beyond their operational needs. Cloud resources can then be accessed or modified outside the workload's intended boundary, exposing protected data and allowing unauthorized changes to cloud state. | 2 | 1 | 3 |
| CCC.K8S.TH03 | Long-Lived Credentials are Exposed to Workloads | Long-lived cloud credentials stored in workload configuration, container images, environment variables, or mounted files may be read by a compromised workload or unauthorized user. The credentials can then be used independently of the workload lifecycle. Protected data may be disclosed and resources accessible through those credentials may be modified outside the cluster's authorization controls. | 2 | 1 | 2 |
| CCC.K8S.TH04 | Untrusted Container Images are Deployed | Container images whose provenance, integrity, or vulnerability status is not verified may contain unsupported software, altered components, or embedded credentials and be admitted to the cluster. The image is then executed within the workload environment and can expose secrets, alter application data, or disrupt connected services. | 2 | 1 | 1 |
| CCC.K8S.TH05 | Privileged Workloads Escape Isolation | Workloads granted privileged execution, host namespaces, host paths, or unrestricted Linux capabilities may bypass container isolation controls. Processes can then read node data, alter host state, or disrupt neighboring workloads, defeating the confidentiality, integrity, and availability boundaries of the shared worker infrastructure. | 2 | 1 | 2 |
| CCC.K8S.TH06 | Workload Network Segmentation is Not Enforced | Absent or ineffective ingress and egress policies may allow traffic to flow between namespaces, workloads, and external systems without an explicit authorization boundary. Network services can then be discovered or reached from unintended sources, exposing data flows, permitting unauthorized interaction, and increasing the risk of workload disruption. | 2 | 1 | 1 |
| CCC.K8S.TH07 | Secrets are Exposed to Unauthorized Workloads | Misconfigured secret access, namespace boundaries, or workload mounts may expose sensitive values to workloads or users that do not require them. Credentials, keys, or certificates can then be read from Kubernetes or external secret interfaces, exposing the secrets and enabling unauthorized changes to the resources they protect. | 2 | 1 | 2 |
| CCC.K8S.TH08 | Cluster Extensions Execute Untrusted Code | An operator, controller, admission webhook, or managed extension installed without verified provenance and constrained permissions may execute untrusted code with cluster-level access. The extension can intercept sensitive data, rewrite cluster state, or interrupt workloads across its granted scope. | 2 | 1 | 1 |
| CCC.K8S.TH09 | Unsupported Cluster Components Remain in Use | Control-plane, worker, runtime, or extension versions outside their supported lifecycles may retain known vulnerabilities and compatibility defects. Exposed components can then be exploited or may fail during service changes, leading to data exposure, loss of cluster-state integrity, or workload interruption. | 2 | 1 | 2 |
| CCC.K8S.TH10 | Workload Endpoints are Exposed Unintentionally | Services, load balancers, ingress resources, or gateways configured with an unintended external scope may make workload endpoints reachable from untrusted networks. Exposed services can then disclose workload data, accept unauthorized changes, or consume capacity needed by legitimate users. | 2 | 1 | 2 |
| CCC.K8S.TH11 | Persistent Volumes are Bound to Unauthorized Workloads | Misconfigured persistent-volume claims, storage classes, or workload authorization may allow a volume to be mounted outside its intended ownership boundary. Data stored on the volume can then be read, modified, or deleted through the unauthorized workload, directly reducing its confidentiality, integrity, and availability. | 2 | 1 | 1 |
| CCC.K8S.TH12 | Admission Controls are Bypassed | Admission policies that omit resources, namespaces, or API paths may allow a Kubernetes request to be accepted without the intended validation or mutation. Workloads and configuration that violate security requirements can then be persisted, weakening cluster-policy integrity and exposing workloads to unauthorized access or disruption. | 2 | 1 | 2 |
| CCC.K8S.TH13 | Controllers Reconcile Unauthorized Cluster State | A controller or scheduled workload granted excessive scope may repeatedly create or restore unauthorized resources and configuration through its reconciliation loop. Manual remediation can then be overwritten, restoring unsafe cluster state that exposes workload data or interferes with service availability. | 2 | 1 | 2 |
| CCC.K8S.TH14 | Node Administrative Interfaces Expose Cluster Credentials | Node administrative interfaces reachable without sufficient authentication or network restriction may expose node metadata, workload credentials, logs, or execution functions. The node can then be queried or controlled outside the intended management path, allowing credential disclosure, unauthorized host changes, or disruption of scheduled workloads. | 2 | 1 | 1 |
| CCC.K8S.TH15 | Kubernetes Audit Records are Incomplete or Unavailable | Audit policies, log categories, collection agents, export destinations, or retention settings that omit security-relevant activity may leave required Kubernetes records incomplete or unavailable. Cluster access and configuration changes can then occur without a reliable investigative trail, delaying detection and weakening the integrity and availability of security monitoring and incident response. | 2 | 1 | 1 |
| CCC.K8S.TH16 | Unmanaged Credentials Bypass Cluster Identity Controls | Locally managed accounts, static administrative credentials, or legacy authentication methods may remain valid after the associated identity should lose access. Requests authenticated by these mechanisms can bypass centrally managed identity lifecycle and revocation controls. Cluster data may be disclosed, cluster state may be changed, and workloads may be disrupted through unauthorized administrative access. | 2 | 1 | 1 |
| CCC.K8S.TH17 | Cluster Infrastructure Identities Grant Excessive Cloud Access | Cloud identities used by control-plane, worker-node, or supporting components may be shared or granted permissions beyond their platform responsibilities. A component using such an identity can access or modify cloud resources outside its intended boundary. Protected cloud data may be disclosed, cloud resource integrity may be lost, and services required by the cluster may be disrupted. | 2 | 1 | 1 |
| CCC.K8S.TH18 | Worker Node Integrity Is Not Verified | Worker nodes created from untrusted or altered images, or started without boot integrity verification, may execute modified software beneath the container runtime. Modified node components can observe workload data and credentials or alter workload execution. Workload confidentiality and integrity may be lost, and node or cluster availability may be reduced. | 2 | 1 | 1 |