CME-206
Network Policy (Kubernetes)
Description
Kubernetes NetworkPolicy resources that restrict pod-to-pod and pod-to-external communication. Default-deny ingress/egress with explicit allowlists.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Vector (AV) | N → A | Pod only reachable from explicitly allowed sources |
| Scope (S) | C → U | Compromised pod cannot reach arbitrary cluster services |
CWE Relationships
Verification
Check for default-deny NetworkPolicy in namespace
$ kubectl get networkpolicy -n <namespace> -o name | head -5
# Expected: networkpolicy.networking.k8s.io/default-deny
# Expected: networkpolicy.networking.k8s.io/default-deny
Platform: kubernetes
Applicability (CVE 5.2.0 Schema)
| Vendor | Product | CPEs | Platforms | Status |
|---|---|---|---|---|
| kubernetes | kubernetes |
cpe:2.3:a:kubernetes:kubernetes:*:*:*:*:*:*:*:*
|
All | applicable |
| redhat | openshift_container_platform |
cpe:2.3:a:redhat:openshift_container_platform:4:*:*:*:*:*:*:*
|
All | applicable |
| google_kubernetes_engine | All | applicable | ||
| amazon | elastic_kubernetes_service | All | applicable | |
| microsoft | azure_kubernetes_service | All | applicable |