AI
Reviving the OWASP Kubernetes Top 10
The OWASP Kubernetes Top 10 was created around 2021 and then went unmaintained. Rory McCune’s SIG Security Docs sub-project took it over after noticing people were still using the outdated list as a primary reference. The team brainstormed 12 candidate items, ran a community survey that collected over 150 responses for ranking and ordering, distributed drafting across contributors, gathered review feedback from first-time contributors, and published the updated list last week.
Third-Party Audit: 93 Components, Lingering Findings
Iain Smart’s sub-project coordinates external security reviews of Kubernetes. The core repo holds between 2.5 and 3.8 million lines of Go depending on how you count, and it had already been reviewed twice, by Trail of Bits in 2019 and NCC Group in 2022. This cycle, Shielder audited 93 non-core component areas through summer 2024, funded by the Open Source Technology Improvement Fund. Before starting, the team checked prior findings: 13 of 37 items from the 2019 audit remain open, including one that just turned 10 years old relating to certificate revocation. Nine findings from the NCC audit are still open.
How the Security Response Committee Handles CVEs
Tabitha Sable runs the confidential side of Kubernetes security through the Security Response Committee. Reports arrive via the Kubernetes bug bounty program on HackerOne or security@kubernetes.io. Members rotate weekly on-call to triage each report: does the software behave as claimed, and does that behavior violate a reasonable security expectation? If yes, maintainers fix it privately before disclosure goes to hundreds of thousands of Kubernetes mailing list subscribers, the open-source security list, Kubernetes Slack announcements, and the CVE database.
CVE-2025-1974 and the Challenge of CVSS Scoring
Two recent ingress-nginx CVEs illustrate how features, not just bugs, become vulnerabilities. Sending gigabytes of data to the admission webhook can crash a pod or take down the node. A second issue, CVE-2025-1974, went further: the nginx config test run inside the admission controller can be tricked into loading and executing arbitrary code from the file system. Sable called it probably the most serious vulnerability in Kubernetes history. CVSS scoring for Kubernetes is complicated because “network vs. local” and “privileges required” mean different things in a cluster context than in the formula’s defaults.
CLI Tooling That Produces OSV Output as a Byproduct
Mahé Tardy’s SIG Security Tooling sub-project built a small CLI to ease CVE disclosure work for SRC members. It works like a guided form, walking through questions in a git-commit style and exporting results as issue templates, email drafts, or Slack messages. A byproduct of each completed form is a structured OSV JSON record. Tabitha Sable used it during the wave of ingress-nginx disclosures and confirmed it reduced repetitive work. The team now plans to merge new OSV records with historically hand-written ones to produce a single complete machine-readable CVE feed.
Notable Quotes
that feature very quickly became recognized as probably the most serious vulnerability in Kubernetes history Tabitha Sable · ▶ 15:52
Don’t volunteer for anything. You just get more responsibilities. Iain Smart · ▶ 07:05
we don’t have a membership roster. We are made up of whoever shows up. Ian Coldwater · ▶ 28:57
if you are like searching for simple issues and a way to enter SI security I think it’s a good way to start with Mahé Tardy · ▶ 28:03
Key Takeaways
- The updated OWASP Kubernetes Top 10 shipped last week, informed by 150+ community survey responses.
- 13 of 37 findings from the 2019 audit remain open; the oldest turns 10 this year.
- CVE-2025-1974 in ingress-nginx is rated the most serious Kubernetes vulnerability on record.
- A new SRC CLI tool generates structured OSV records automatically during the disclosure workflow.
- A “won’t fix” CVE label is coming to prevent confusion about unfixed entries on outdated Kubernetes versions.
About the Speaker(s)
Ian Coldwater is co-chair of Kubernetes SIG Security, a longtime community organizer, and a security researcher specializing in hacking and hardening Kubernetes, containers, and cloud native infrastructure. When they’re not busy making good trouble, they like to read all the docs.
Tabitha Sable never met a system she didn’t want to take apart. She serves the Kubernetes community as co-chair of SIG Security and a member of the Security Response Committee. At work, Tabitha is Systems Security Engineer at Datadog. She writes exploits, hardens infrastructure, and more.
Rory McCune is a senior advocate for Datadog with extensive experience in cybersecurity and cloud native computing. He has worked as a security reviewer and architect on containerization technologies including Kubernetes and Docker, and has presented at KubeCon EU and NA.
Iain Smart is a Principal Consultant at AmberWolf, where he reviews cloud-native deployments and performs offensive security engagements. He enjoys playing with new technologies, and if he’s not hacking a Kubernetes cluster or attacking a build pipeline he can probably be found writing.
Mahé Tardy is a Software Engineer at Isovalent working on Tetragon and an active contributor to Kubernetes SIG Security. He was previously a security researcher and works extensively with Linux, security, and Kubernetes.