When “Read-Only” Isn’t: K8s nodes/proxy GET to RCE

Published

2026-02-27 15:59

Collected

2026-10-21 15:18

---
id: 10183
title: "When “Read-Only” Isn’t: K8s nodes/proxy GET to RCE"
source_domain: horizon3.ai
source_url: "https://horizon3.ai/attack-research/when-read-only-isnt-k8s-nodes-proxy-get-to-rce/"
published_at: "2026-02-27T15:59:42Z"
tags: ["rce", "vulnerability-research", "kubernetes"]
phying_url: "https://phying.com/item/10183"
lang: en
---

# When “Read-Only” Isn’t: K8s nodes/proxy GET to RCE

## Summary

A Kubernetes service account with “read-only” nodes/proxy GET permission can execute arbitrary commands across pods via the kubelet API. This post breaks down…

## Intelligence Metadata

- **Sources:** horizon3.ai
- **Published:** 2026-02-27T15:59:42Z
- **Original:** https://horizon3.ai/attack-research/when-read-only-isnt-k8s-nodes-proxy-get-to-rce/
- **Phying News:** https://phying.com/item/10183