# Security Hardening and Compliance Assessment of Kubernetes Control Plane and Workloads
## 5 Kubernetes Vulnerabilities and Kubernetes Penetration Testing
### Kubernetes CVEs
CVE-2024-7646  
Component: Ingress-NGINX Controller  
A validation bypass vulnerability enables attackers to alter annotations and inject harmful configurations, which may result in privilege escalation or data exfiltration. Reduction in severity or seriousness: Upgrade to ingress-nginx version 1.11.2 or subsequent releases. Authenticate ingress annotations and limit annotation application via policy enforcement mechanisms such as OPA/Gatekeeper. 7. CVE-2024-29990 Element: Azure Kubernetes Service (AKS)  
A security vulnerability in AKS may result in unauthorized access or privilege escalation within the cluster environment, jeopardizing the confidentiality and integrity of workloads. Reduction in severity or seriousness: Implement the most recent updates for Microsoft's AKS and evaluate Azure role assignments. Utilize Azure Policy and Defender for Cloud to mandate secure cluster configurations. * CVE-2024-9486
* Kubernetes Image Builder  
This vulnerability permits unauthorized individuals to obtain root-level access to virtual machines utilized in image construction, potentially jeopardizing the supply chain. Reduction in severity or seriousness: Upgrade the Kubernetes Image Builder to version 0.1.38 or later. Limit access to build infrastructure and segregate it from production systems. * CVE-2024-10220  
Element: Kubernetes Clusters Utilization of gitRepo Volume Description: Individuals possessing pod creation privileges can employ the gitRepo volume type to access local git repositories from alternative pods, resulting in potential data leakage. Reduction in severity or seriousness: Upgrade to Kubernetes versions v1.31.0, v1.30.3, v1.29.7, or v1.28.12. Refrain from utilizing gitRepo volumes and, instead, execute Git clone operations through init containers. Table 1 summarizes the CVEs examined in Section 5.2, contextualizing real-world threats within the proposed framework. Each item links a specific risk to its affected component and suggests mitigation strategies, underscoring the importance of architectural fortification in protecting against recognized threats. \begin{table}
\begin{tabular}{l l l l} \hline
**CVE ID** & **Affected Component** & **Vulnerability/Risk** & **Recommended Mitigation** \\ \hline CVE-2025-1974 & Ingress-NGINX Controller & Unauthenticated remote & Upgrade ingress-nginx; apply \\  & & code execution & network restrictions and RBAC \\  & & & Update ingress-nginx; enforce \\  & & Remote code execution & network segmentation and review \\  & & & ingress policies \\  & & & Patch ingress-nginx; implement \\  & & Remote code execution via & configuration validation and least \\  & & misconfiguration & privilege \\  & & Unauthorized code & Upgrade ingress-nginx; monitor \\  & & execution through & ingress logs; sanitize input \\  & & malicious requests & annotations \\  & & Command injection via & Upgrade Windows kubelet; restrict \\  & & & insecure parameter & access using RBAC and firewalls \\  & & handling & \\  & & Privilege escalation via & Upgrade to ingress-nginx \(\geq\) v1.11.2; \\  & & annotation injection & apply OPA/Gatekeeper policies \\  & & Azure Kubernetes Service & Privilege escalation within \\  & & AKS & enforce Azure role and policy \\  & & & restrictions \\ \hline \end{tabular}
\end{table} 
Table 1: Summary of Kubernetes CVEs and mitigations. The enumerated CVEs underscore vulnerabilities within Kubernetes ecosystems, especially ingress controllers, runtime elements, and improperly configured integrations. These findings emphasize the necessity for ongoing vulnerability surveillance, swift patch management, and proactive architectural design--all fundamental principles of the methodology presented in this study. The analyzed CVEs highlight the advancing security issues within the Kubernetes ecosystem, especially concerning ingress controllers, configuration vulnerabilities, and platform integrations. Prompt patching, stringent Role-Based Access Control (RBAC), and ongoing monitoring are crucial for risk mitigation and ensuring strong cluster security.