Kubernetes RBAC Bypass (CVE-2026-1247): Cluster Admin Escalation Affects All Major Cloud Providers

A critical RBAC bypass in Kubernetes 1.29–1.31 allows any authenticated user to escalate to cluster-admin via malformed ServiceAccount token projection. CVSS 9.1. All major cloud providers affected. Patch immediately.

---

Executive Summary

A critical vulnerability in Kubernetes RBAC (Role-Based Access Control) has been discovered that allows any authenticated user — including those with minimal permissions — to escalate their privileges to full cluster-admin access. The flaw exists in how the API server processes projected ServiceAccount tokens with specially crafted audience claims.

Technical Analysis

The vulnerability resides in the kube-apiserver's token projection validation logic. When a pod requests a projected ServiceAccount token with multiple audience claims, the API server's RBAC evaluation incorrectly merges permission sets from different ClusterRoleBindings.

Attack Flow

1. Attacker creates a pod spec with a projected ServiceAccount token containing crafted audience values
2. The TokenRequest API generates a token with overlapping audience claims
3. When this token is used for API authentication, the RBAC evaluator incorrectly resolves bindings from unrelated ClusterRoles
4. This results in effective cluster-admin permissions for the attacker's ServiceAccount

Impact Assessment

This is as bad as it gets for Kubernetes security:

• Full cluster compromise — read/write access to all namespaces, secrets, and workloads
• Lateral movement — pivot to other clusters via shared service accounts or federated identity
• Data exfiltration — access to all ConfigMaps, Secrets (including TLS certs and cloud provider credentials)
• Supply chain risk — ability to modify running workloads, inject malicious containers, or alter CI/CD pipelines

Affected Cloud Providers

Immediate Remediation

1. Patch immediately — upgrade to 1.29.15, 1.30.11, or 1.31.7
2. Audit ServiceAccount tokens — review all projected token configurations for anomalous audience claims
3. Enable audit logging — monitor for TokenRequest API calls with multiple audiences
4. Network policies — restrict pod-to-API-server communication where possible
5. Rotate credentials — assume compromise and rotate all cluster secrets if you detect anomalous activity

Detection

Look for these indicators of compromise in your audit logs:

• TokenRequest calls with more than 2 audience values
• Unexpected system:serviceaccount subjects in ClusterRoleBinding audit events
• ServiceAccount tokens being used from IP addresses outside normal pod CIDR ranges
• Sudden increase in secrets read operations from low-privilege namespaces

---