SEC-003.md

SEC-003 ServiceAccount has cluster-admin

Summary

A ServiceAccount is bound to cluster-admin (or equivalent). Workloads using this account have full cluster access; a compromise can lead to cluster takeover.

Severity

Warning

Example

N/A

Symptoms

• Report shows that a ServiceAccount has cluster-admin
• ServiceAccount is subject of a ClusterRoleBinding to cluster-admin

Resolution

1. Replace with a Role or limited ClusterRole that grants only required permissions
2. Prefer namespace-scoped Role and RoleBinding for application ServiceAccounts
3. Use dedicated ServiceAccounts per workload and avoid sharing high-privilege accounts
4. Audit which pods use the ServiceAccount and reduce scope

References

• RBAC
• ServiceAccounts