Misconfigured secret access, namespace boundaries, or workload mounts may expose sensitive values to workloads or users that do not require them. Credentials, keys, or certificates can then be read from Kubernetes or external secret interfaces, exposing the secrets and enabling unauthorized changes to the resources they protect.
Secrets are Exposed to Unauthorized Workloads
CCC.K8S.TH07
Related Capabilities
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CP12 | Secrets Service Integration | The service can present secrets, keys, and certificates from a cloud secrets service to authorized Kubernetes workloads without embedding them in workload definitions. |
Related Controls
| ID | Title | Description |
|---|---|---|
| CCC.K8S.CN03 | Use Federated Identities for Workloads | Replace stored cloud credentials with narrowly scoped, short-lived federated identity for workload access to cloud services. |
| CCC.K8S.CN07 | Protect Workload Secrets | Protect workload secrets through encrypted handling, narrow authorization, and removal from images and non-secret configuration objects. |
External Mappings
| Framework | ID | Relationship | Remarks |
|---|---|---|---|
| CWE | CWE-200 | relates-to | Exposure of Sensitive Information to an Unauthorized Actor |
| CWE | CWE-522 | relates-to | Insufficiently Protected Credentials |
| MITRE-ATT&CK | T1552.001 | relates-to | Unsecured Credentials - Credentials In Files |
| MITRE-ATT&CK | T1552.007 | relates-to | Unsecured Credentials - Container API |