{"uuid": "66a1c77d-3fb5-4ef8-a86c-1ad9aacf5d44", "vulnerability_lookup_origin": "1a89b78e-f703-45f3-bb86-59eb712668bd", "author": "9f56dd64-161d-43a6-b9c3-555944290a09", "vulnerability": "GHSA-JHJP-4C2Q-XMX4", "type": "seen", "source": "https://gist.github.com/alon710/f0da16101e0126a7387302a2b36a1565", "content": "# GHSA-JHJP-4C2Q-XMX4: GHSA-JHJP-4C2Q-XMX4: Falco k8saudit Plugin Ruleset Bypass via initContainers and ephemeralContainers\n\n> **CVSS Score:** 8.1\n> **Published:** 2026-09-21\n> **Full Report:** https://cvereports.com/reports/GHSA-JHJP-4C2Q-XMX4\n\n## Summary\nA security feature bypass vulnerability in the Falco k8saudit plugin (and its cloud-specific variants) allowed privileged workloads to run undetected. This bypass occurred because the plugin's default extraction logic and rules only evaluated standard containers, completely omitting initContainers and ephemeralContainers.\n\n## TL;DR\nThe Falco k8saudit plugin failed to parse initContainers and ephemeralContainers, allowing users with pod creation privileges to deploy undetected privileged workloads.\n\n## Exploit Status: POC\n\n## Technical Details\n\n- **CWE ID**: CWE-20 / CWE-285\n- **Attack Vector**: Network (Kubernetes API Server)\n- **CVSS Base Score**: 8.1 (High)\n- **Exploit Status**: Proof-of-Concept\n- **Impact**: Security Bypass / Detection Evasion\n- **Remediation**: Upgrade k8saudit plugin to v0.18.0\n\n## Affected Systems\n\n- falcosecurity/plugins (k8saudit)\n- falcosecurity/plugins (k8saudit-aks)\n- falcosecurity/plugins (k8saudit-eks)\n- falcosecurity/plugins (k8saudit-gke)\n- falcosecurity/plugins (k8saudit-ovh)\n- **falcosecurity/plugins - k8saudit**: < v0.18.0 (Fixed in: `v0.18.0`)\n- **falcosecurity/plugins - k8saudit-eks**: < v0.12.0 (Fixed in: `v0.12.0`)\n- **falcosecurity/plugins - k8saudit-gke**: < v0.9.0 (Fixed in: `v0.9.0`)\n- **falcosecurity/plugins - k8saudit-aks**: < v0.6.0 (Fixed in: `v0.6.0`)\n- **falcosecurity/plugins - k8saudit-ovh**: < v0.6.0 (Fixed in: `v0.6.0`)\n\n## Mitigation\n\n- Upgrade Falco k8saudit plugin to version v0.18.0 or later.\n- Upgrade cloud-specific wrappers (k8saudit-aks, k8saudit-eks, k8saudit-gke, k8saudit-ovh) to their respective patched versions.\n- Deploy admission controllers (e.g., Kyverno, OPA Gatekeeper) to enforce policy restrictions on initContainers and ephemeralContainers.\n\n**Remediation Steps:**\n1. Identify active Falco installations and audit the current version of the k8saudit plugin configuration.\n2. Update the plugin version references in helm configurations (e.g., values.yaml) or plugin configuration manifests.\n3. Verify rule definitions are updated to include the 'any_container_privileged' macro definition.\n4. Apply the configuration update and restart the Falco daemonset to load the patched library.\n5. Optionally implement the provided Kyverno policy to enforce safety boundaries at the API Server entrypoint.\n\n## References\n\n- [GHSA-JHJP-4C2Q-XMX4 Advisory Details](https://github.com/advisories/GHSA-JHJP-4C2Q-XMX4)\n- [Fix Pull Request 1400](https://github.com/falcosecurity/plugins/pull/1400)\n- [Fix Commit 0adb9b3c](https://github.com/falcosecurity/plugins/commit/0adb9b3c7e2c8bad53f30d01c057e038b2afa5e1)\n- [k8saudit-aks v0.6.0 Release](https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-aks/v0.6.0)\n- [k8saudit-eks v0.12.0 Release](https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-eks/v0.12.0)\n- [k8saudit-gke v0.9.0 Release](https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-gke/v0.9.0)\n- [k8saudit-ovh v0.6.0 Release](https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-ovh/v0.6.0)\n- [k8saudit v0.18.0 Release](https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit/v0.18.0)\n\n\n---\n*Generated by [CVEReports](https://cvereports.com/reports/GHSA-JHJP-4C2Q-XMX4) - Automated Vulnerability Intelligence*", "creation_timestamp": "2026-09-22T01:31:26.674646Z"}