CCC Kubernetes Threats Catalog
This page renders the FINOS Common Cloud Controls Managed Kubernetes threats as a
Gemara ThreatCatalog. It includes shared CCC Core
threats this service imports, plus CWE and MITRE ATT&CK mappings shown on each
matching threat.
For the companion catalogs, see the Capabilities Catalog and Controls Catalog.
Access Control
The Access Control group covers entries related to authentication, authorization, and trust perimeter enforcement. This includes multi-factor authentication, least privilege access, network access rules, and prevention of unauthorized access or reconnaissance.
CCC.K8S.TH01Kubernetes API is Exposed to Untrusted Networks
An API endpoint without network restrictions may be reached from untrusted networks. Cluster resources and configuration can then be enumerated or modified through exposed administrative interfaces. Cluster data may be disclosed, configuration integrity may be lost, and workloads may be disrupted.
CCC.K8S.CapabilitiesCCC.K8S.CP01Managed Kubernetes Control PlaneCCC.K8S.CP10Cloud Identity Integration
CCC.Core.CapabilitiesCCC.Core.CP14API AccessCCC.Core.CP23Network Access Rules
CWE-284Improper Access Control
T1609Container Administration CommandT1613Container and Resource Discovery
CCC.K8S.TH02Workload Identity Grants Excessive Cloud Access
A Kubernetes service account bound to an overprivileged cloud identity may give its workloads permissions beyond their operational needs. Cloud resources can then be accessed or modified outside the workload's intended boundary, exposing protected data and allowing unauthorized changes to cloud state.
CCC.K8S.CapabilitiesCCC.K8S.CP10Cloud Identity IntegrationCCC.K8S.CP11Workload Identity Federation
CWE-269Improper Privilege Management
T1078.004Valid Accounts - Cloud AccountsT1098.003Account Manipulation - Additional Cloud Roles
CCC.K8S.TH03Long-Lived Credentials are Exposed to Workloads
Long-lived cloud credentials stored in workload configuration, container images, environment variables, or mounted files may be read by a compromised workload or unauthorized user. The credentials can then be used independently of the workload lifecycle. Protected data may be disclosed and resources accessible through those credentials may be modified outside the cluster's authorization controls.
CCC.K8S.CapabilitiesCCC.K8S.CP11Workload Identity FederationCCC.K8S.CP12Secrets Service Integration
CWE-522Insufficiently Protected Credentials
T1552.001Unsecured Credentials - Credentials In Files
CCC.K8S.TH07Secrets are Exposed to Unauthorized Workloads
Misconfigured secret access, namespace boundaries, or workload mounts may expose sensitive values to workloads or users that do not require them. Credentials, keys, or certificates can then be read from Kubernetes or external secret interfaces, exposing the secrets and enabling unauthorized changes to the resources they protect.
CCC.K8S.CapabilitiesCCC.K8S.CP12Secrets Service Integration
CWE-200Exposure of Sensitive Information to an Unauthorized ActorCWE-522Insufficiently Protected Credentials
T1552.001Unsecured Credentials - Credentials In FilesT1552.007Unsecured Credentials - Container API
CCC.K8S.TH12Admission Controls are Bypassed
Admission policies that omit resources, namespaces, or API paths may allow a Kubernetes request to be accepted without the intended validation or mutation. Workloads and configuration that violate security requirements can then be persisted, weakening cluster-policy integrity and exposing workloads to unauthorized access or disruption.
CCC.K8S.CapabilitiesCCC.K8S.CP18Admission Policy Enforcement
CWE-693Protection Mechanism Failure
T1685Disable or Modify ToolsT1609Container Administration Command
CCC.K8S.TH14Node Administrative Interfaces Expose Cluster Credentials
Node administrative interfaces reachable without sufficient authentication or network restriction may expose node metadata, workload credentials, logs, or execution functions. The node can then be queried or controlled outside the intended management path, allowing credential disclosure, unauthorized host changes, or disruption of scheduled workloads.
CCC.K8S.CapabilitiesCCC.K8S.CP02Managed Worker PoolsCCC.K8S.CP03Abstracted Worker InfrastructureCCC.K8S.CP19Workload Isolation Controls
CWE-306Missing Authentication for Critical Function
T1552.007Unsecured Credentials - Container APIT1609Container Administration Command
CCC.K8S.TH16Unmanaged Credentials Bypass Cluster Identity Controls
Locally managed accounts, static administrative credentials, or legacy authentication methods may remain valid after the associated identity should lose access. Requests authenticated by these mechanisms can bypass centrally managed identity lifecycle and revocation controls. Cluster data may be disclosed, cluster state may be changed, and workloads may be disrupted through unauthorized administrative access.
CCC.K8S.CapabilitiesCCC.K8S.CP10Cloud Identity Integration
CWE-287Improper Authentication
T1078Valid Accounts
CCC.K8S.TH17Cluster Infrastructure Identities Grant Excessive Cloud Access
Cloud identities used by control-plane, worker-node, or supporting components may be shared or granted permissions beyond their platform responsibilities. A component using such an identity can access or modify cloud resources outside its intended boundary. Protected cloud data may be disclosed, cloud resource integrity may be lost, and services required by the cluster may be disrupted.
CCC.K8S.CapabilitiesCCC.K8S.CP02Managed Worker PoolsCCC.K8S.CP21Cluster Infrastructure Identity
CWE-269Improper Privilege Management
T1078.004Valid Accounts - Cloud Accounts
CCC.Core.TH01Access is Granted to Unauthorized Usersimported
Imported from CCC.Core.Threats
Logic designed to give different permissions to different entities may be misconfigured or manipulated, allowing unauthorized entities to access restricted parts of the service, its data, or its child resources. This could result in a loss of data confidentiality or tolerance of unauthorized actions which impact the integrity and availability of resources and data.
CCC.Core.CapabilitiesCCC.Core.CP06Access ControlCCC.Core.CP29Active Ingestion
CCC.Core.TH15Automated Enumeration and Reconnaissance by Non-human Entitiesimported
Imported from CCC.Core.Threats
Automated processes may be used to gather details about service and child resource elements such as APIs, file systems, or directories. This information can reveal vulnerabilities, misconfigurations, and the network topology, which can be used to plan an attack against the system, the service, or its child resources.
CCC.Core.CapabilitiesCCC.Core.CP14API Access
CCC.Core.TH17Responses are Generated for Unauthorized Requestsimported
Imported from CCC.Core.Threats
The service may generate responses to requests from unauthorized entities. This could lead to the exposure of system details, which may be used to plan an attack against the service, system, or network. Additionally, allocating resources to service the request could lead to a denial of service for legitimate users, leading to a loss of availability anywhere in the system.
CCC.Core.CapabilitiesCCC.Core.CP29Active Ingestion
Resource Management
The Resource Management group covers entries related to the lifecycle, configuration, and operational integrity of cloud resources. This includes resource exhaustion, tag manipulation, version rollback, scaling, and cost management.
CCC.K8S.TH04Untrusted Container Images are Deployed
Container images whose provenance, integrity, or vulnerability status is not verified may contain unsupported software, altered components, or embedded credentials and be admitted to the cluster. The image is then executed within the workload environment and can expose secrets, alter application data, or disrupt connected services.
CCC.K8S.CapabilitiesCCC.K8S.CP04OCI Container Image ExecutionCCC.K8S.CP05Container Registry Integration
CWE-494Download of Code Without Integrity Check
T1195.002Supply Chain Compromise - Compromise Software Supply ChainT1525Implant Internal ImageT1610Deploy Container
CCC.K8S.TH09Unsupported Cluster Components Remain in Use
Control-plane, worker, runtime, or extension versions outside their supported lifecycles may retain known vulnerabilities and compatibility defects. Exposed components can then be exploited or may fail during service changes, leading to data exposure, loss of cluster-state integrity, or workload interruption.
CCC.K8S.CapabilitiesCCC.K8S.CP02Managed Worker PoolsCCC.K8S.CP03Abstracted Worker InfrastructureCCC.K8S.CP15Cluster Version Management
CWE-1104Use of Unmaintained Third Party Components
T1190Exploit Public-Facing ApplicationT1611Escape to Host
CCC.Core.TH11Publications are Incorrectly Triggeredimported
Imported from CCC.Core.Threats
Incorrectly triggered publications may disseminate inaccurate or misleading information, creating a data integrity risk. Such misinformation can cause unintended operations to be initiated, conceal legitimate issues, and disrupt the availability or reliability of systems and their data.
CCC.Core.CapabilitiesCCC.Core.CP07Event PublicationCCC.Core.CP17Alerting
CCC.Core.TH12Resource Constraints are Exhaustedimported
Imported from CCC.Core.Threats
Exceeding the resource constraints through excessive consumption, resource-intensive operations, or lowering of rate-limit thresholds can impact the availability of elements such as memory, CPU, or storage. This may disrupt availability of the service or child resources by denying the associated functionality to users. If the impacted system is not designed to expect such a failure, the effect could also cascade to other services and resources.
CCC.Core.CapabilitiesCCC.Core.CP04Transaction Rate LimitsCCC.Core.CP16BudgetingCCC.Core.CP19Auto-scaling
CCC.Core.TH13Resource Tags are Manipulatedimported
Imported from CCC.Core.Threats
When resource tags are altered, it can lead to misclassification or mismanagement of resources. This can reduce the efficacy of organizational policies, billing rules, or network access rules. Such changes could cause compromised confidentiality, integrity, or availability of the system and its data.
CCC.Core.CapabilitiesCCC.Core.CP20Tagging
CCC.Core.TH16Publications are Disabledimported
Imported from CCC.Core.Threats
Publication of events, metrics, and runtime logs may be disabled, leading to a lack of expected security and operational information being shared. This can impact system availability by delaying the detection of incidents while also impacting system design decisions and enforcement of operational thresholds, such as autoscaling or cost management.
CCC.Core.CapabilitiesCCC.Core.CP10LoggingCCC.Core.CP09Metrics Publication
CCC.Core.TH18Encryption Key is Misusedimported
Imported from CCC.Core.Threats
Encryption keys may be used by an unauthorized entity due to inadequate key management practices or the compromise of a connected system. This could lead to the decryption of sensitive data, impacting its confidentiality and integrity.
CCC.Core.CapabilitiesCCC.Core.CP01Encryption in Transit Enabled by DefaultCCC.Core.CP02Encryption at Rest Enabled by Default
Compute
The Compute group covers entries related to processing, execution, and runtime infrastructure. This includes CPU, memory, storage allocation, network ports, command-line interfaces, and elastic scaling.
CCC.K8S.TH05Privileged Workloads Escape Isolation
Workloads granted privileged execution, host namespaces, host paths, or unrestricted Linux capabilities may bypass container isolation controls. Processes can then read node data, alter host state, or disrupt neighboring workloads, defeating the confidentiality, integrity, and availability boundaries of the shared worker infrastructure.
CCC.K8S.CapabilitiesCCC.K8S.CP02Managed Worker PoolsCCC.K8S.CP03Abstracted Worker InfrastructureCCC.K8S.CP18Admission Policy EnforcementCCC.K8S.CP19Workload Isolation Controls
CWE-250Execution with Unnecessary Privileges
T1611Escape to Host
CCC.K8S.TH18Worker Node Integrity Is Not Verified
Worker nodes created from untrusted or altered images, or started without boot integrity verification, may execute modified software beneath the container runtime. Modified node components can observe workload data and credentials or alter workload execution. Workload confidentiality and integrity may be lost, and node or cluster availability may be reduced.
CCC.K8S.CapabilitiesCCC.K8S.CP02Managed Worker PoolsCCC.K8S.CP03Abstracted Worker InfrastructureCCC.K8S.CP22Worker Node Integrity Protection
CWE-494Download of Code Without Integrity Check
T1542.003Pre-OS Boot - Bootkit
Networking
The Networking group covers entries related to network infrastructure, connectivity, and traffic management. This includes virtual networks, subnets, load balancing, DNS, routing, peering, and network-level access controls.
CCC.K8S.TH06Workload Network Segmentation is Not Enforced
Absent or ineffective ingress and egress policies may allow traffic to flow between namespaces, workloads, and external systems without an explicit authorization boundary. Network services can then be discovered or reached from unintended sources, exposing data flows, permitting unauthorized interaction, and increasing the risk of workload disruption.
CCC.K8S.CapabilitiesCCC.K8S.CP07Cluster Network IntegrationCCC.K8S.CP09Workload Network Policy
CWE-284Improper Access Control
T1046Network Service DiscoveryT1686.001Disable or Modify System Firewall - Cloud Firewall
CCC.K8S.TH10Workload Endpoints are Exposed Unintentionally
Services, load balancers, ingress resources, or gateways configured with an unintended external scope may make workload endpoints reachable from untrusted networks. Exposed services can then disclose workload data, accept unauthorized changes, or consume capacity needed by legitimate users.
CCC.K8S.CapabilitiesCCC.K8S.CP08Workload Traffic Routing
CWE-284Improper Access Control
T1046Network Service DiscoveryT1190Exploit Public-Facing Application
Orchestration
The Orchestration group covers entries related to coordinating and managing workloads across distributed systems. This includes container orchestration, job scheduling, CI/CD pipelines, build automation, and service mesh management.
CCC.K8S.TH08Cluster Extensions Execute Untrusted Code
An operator, controller, admission webhook, or managed extension installed without verified provenance and constrained permissions may execute untrusted code with cluster-level access. The extension can intercept sensitive data, rewrite cluster state, or interrupt workloads across its granted scope.
CCC.K8S.CapabilitiesCCC.K8S.CP14Managed Cluster ExtensionsCCC.K8S.CP18Admission Policy Enforcement
CWE-829Inclusion of Functionality from Untrusted Control Sphere
T1195.002Supply Chain Compromise - Compromise Software Supply ChainT1610Deploy Container
CCC.K8S.TH13Controllers Reconcile Unauthorized Cluster State
A controller or scheduled workload granted excessive scope may repeatedly create or restore unauthorized resources and configuration through its reconciliation loop. Manual remediation can then be overwritten, restoring unsafe cluster state that exposes workload data or interferes with service availability.
CCC.K8S.CapabilitiesCCC.K8S.CP06Declarative Workload OrchestrationCCC.K8S.CP14Managed Cluster Extensions
CWE-284Improper Access Control
T1053.007Scheduled Task or Job - Container Orchestration JobT1609Container Administration Command
Data Resilience
The Data Resilience group covers entries related to ensuring data availability, integrity, and sovereignty across its lifecycle. This includes replication, backup, recovery, region restrictions, and protection against data loss or corruption.
CCC.K8S.TH11Persistent Volumes are Bound to Unauthorized Workloads
Misconfigured persistent-volume claims, storage classes, or workload authorization may allow a volume to be mounted outside its intended ownership boundary. Data stored on the volume can then be read, modified, or deleted through the unauthorized workload, directly reducing its confidentiality, integrity, and availability.
CCC.K8S.CapabilitiesCCC.K8S.CP13Kubernetes Storage Provisioning
CWE-862Missing Authorization
T1613Container and Resource Discovery
CCC.Core.TH02Data is Intercepted in Transitimported
Imported from CCC.Core.Threats
Data transmitted by the service is susceptible to collection by any entity with access to any part of the transmission path. Packet observations can be used to support the planning of attacks by profiling origin points, destinations, and usage patterns. The data may also be vulnerable to interception or modification in transit if not properly encrypted, impacting the confidentiality or integrity of the transmitted data.
CCC.Core.CapabilitiesCCC.Core.CP08Data ReplicationCCC.Core.CP14API Access
CCC.Core.TH03Deployment Region Network is Untrustedimported
Imported from CCC.Core.Threats
Systems are susceptible to unauthorized access or interception by actors with social or physical control over the network in which they are deployed. If the geopolitical status of the deployment network is untrusted, unstable, or insecure, this could result in a loss of confidentiality, integrity, or availability of the service and its data.
CCC.Core.CapabilitiesCCC.Core.CP08Data ReplicationCCC.Core.CP22Location Lock-In
Observability
The Observability group covers entries related to logging, monitoring, metrics, alerting, and event publication. This includes audit trail integrity, enumeration detection, and protection against tampering or unauthorized access to operational telemetry.
CCC.K8S.TH15Kubernetes Audit Records are Incomplete or Unavailable
Audit policies, log categories, collection agents, export destinations, or retention settings that omit security-relevant activity may leave required Kubernetes records incomplete or unavailable. Cluster access and configuration changes can then occur without a reliable investigative trail, delaying detection and weakening the integrity and availability of security monitoring and incident response.
CCC.K8S.CapabilitiesCCC.K8S.CP16Kubernetes Audit LoggingCCC.K8S.CP17Cluster Monitoring Integration
CWE-778Insufficient Logging
T1685.002Disable or Modify Tools - Disable or Modify Cloud Log
CCC.Core.TH07Logs are Tampered With or Deletedimported
Imported from CCC.Core.Threats
Tampering or deletion of service logs will reduce the system's ability to maintain an accurate record of events. Any actions that compromise the integrity of logs could disrupt system availability by disrupting monitoring, hindering forensic investigations, and reducing the accuracy of audit trails.
CCC.Core.CapabilitiesCCC.Core.CP03Access Log PublicationCCC.Core.CP10Logging
CCC.Core.TH09Runtime Logs are Read by Unauthorized Entitiesimported
Imported from CCC.Core.Threats
Unauthorized access to logs may expose valuable information about the system's configuration, operations, and security mechanisms. This could jeopardize system availability through the exposure of vulnerabilities and support the planning of attacks on the service, system, or network. If logs are not adequately sanitized, this may also directly impact the confidentiality of sensitive data.
CCC.Core.CapabilitiesCCC.Core.CP03Access Log PublicationCCC.Core.CP09Metrics Publication
CCC.Core.TH10State-change Events are Read by Unauthorized Entitiesimported
Imported from CCC.Core.Threats
Unauthorized access to state-change events can reveal information about the system's design and usage patterns. This opens the system up to attacks of opportunity and support the planning of attacks on the service, system, or network.
CCC.Core.CapabilitiesCCC.Core.CP03Access Log PublicationCCC.Core.CP07Event PublicationCCC.Core.CP09Metrics PublicationCCC.Core.CP17Alerting