Executive brief
Falco's k8saudit plugin, a Kubernetes security auditing tool, failed to detect privileged container settings when they were declared as init or ephemeral containers rather than regular containers. An attacker with pod creation permissions could run privileged containers without triggering the default security detection rules, bypassing audit controls intended to flag such high-risk deployments.
Technical details
The k8saudit plugin's field extraction logic and shipped audit rules only inspected `requestObject.spec.containers`, ignoring `initContainers` and `ephemeralContainers` in pod specifications. This allowed privileged containers, capability escalations, and other security-sensitive settings to run undetected in those container types. The vulnerability requires pod creation capability and is a detection bypass rather than direct privilege escalation. The fix adds dedicated field families (`ka.req.pod.initContainers.*` and `ka.req.pod.ephemeralContainers.*`) and updates the `Create Privileged Pod` rule to evaluate all three container lists. Cloud variants (k8saudit-eks, k8saudit-gke, k8saudit-aks, k8saudit-ovh) were equally affected.
Affected products
- Falco k8saudit before 0.18.0
- Falco k8saudit-eks before 0.12.0
- Falco k8saudit-gke before 0.9.0
- Falco k8saudit-aks before 0.6.0
- Falco k8saudit-ovh before 0.6.0
Timeline
- 2026-09-21: disclosed: GHSA-jhjp-4c2q-xmx4 published
- 2026-06-19: patched: k8saudit 0.18.0, k8saudit-eks 0.12.0, k8saudit-gke 0.9.0, k8saudit-aks 0.6.0, k8saudit-ovh 0.6.0 released