Improper Access Control
| Property | |
|---|---|
| Language |  |
| Severity |  |
| CWE | CWE-284: Improper Access Control |
| OWASP | A05:2017 - Broken Access Control |
| Confidence Level | Low |
| Impact Level | Low |
| Likelihood Level | Low |
Description#
The GKE cluster configuration is missing ‘master_authorized_networks_config’, which means access to the Kubernetes master endpoint is not restricted to specific IP addresses. This allows connections from any source, increasing exposure to unauthorized access.
Impact#
Without restricting master access, attackers could potentially reach and compromise the Kubernetes control plane, leading to cluster takeover, data breaches, or disruption of services. Sensitive operations and workloads could be exposed to the internet or untrusted networks.