No user or group can modify webhook configurations

​

What this check verifies

User or group RBAC assignments that grant privileges to create, update, or delete validatingwebhookconfigurations and mutatingwebhookconfigurations are identified. Focus is on permissions that allow modifying admission webhook configuration objects.

​

Risk

Excess rights over admission webhooks allow reading or mutating all admitted API objects, undermining confidentiality and integrity. An attacker could inject privileged mutations, bypass policy, or block admissions, leading to privilege escalation and cluster-wide denial of service.

​

Recommendation

• Enforce least privilege; limit webhook config create, update, delete to a small, trusted admin group.
• Avoid wildcard resources/verbs and use separation of duties with change approval.
• Monitor changes via audit logging to provide defense in depth.

​

Remediation

​

References

• https://kubernetes.io/docs/concepts/security/rbac-good-practices/#control-admission-webhooks

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = rbac_minimize_webhook_config_access. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks