Check ID: core_minimize_allowPrivilegeEscalation_containers
Provider: Kubernetes
Service: core
Severity: HIGH
Categories: container-security
Resource type: Pod

​
What this check verifies

Kubernetes Pods are evaluated for containers that enable allowPrivilegeEscalation. The finding highlights pods where any container permits processes to gain extra privileges; pods whose containers set allowPrivilegeEscalation: false are noted as not allowing escalation.

​
Risk

Allowing privilege escalation lets processes acquire elevated rights, undermining container isolation. Attackers can abuse setuid paths and capabilities to tamper with workloads (integrity), read sensitive data (confidentiality), pivot within the cluster, or disrupt services (availability).

​
Recommendation

Set allowPrivilegeEscalation: false by default and apply least privilege:
  • run as non-root; drop caps (drop: ["ALL"])
  • avoid privileged; use readOnlyRootFilesystem
  • enforce via namespace admission policies (e.g., PSA/OPA) and monitor exceptions

​
Remediation

resource "kubernetes_pod" "main" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    container {
      name  = "app"
      image = "nginx"
      security_context {
        allow_privilege_escalation = false # Critical: explicitly disable privilege escalation for the container
      }
    }
  }
}

​
References

​
Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = core_minimize_allowPrivilegeEscalation_containers. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.
← Back to Kubernetes checks