Back to Checks
kubernetes

Pod does not allow privilege escalation in any container

core_minimize_allowPrivilegeEscalation_containers
Service: coreSeverity: high
OfficialBuilt-inVerified
Categories:container-security
Resource Type:Pod

Kubernetes Pods are evaluated for containers that enable allowPrivilegeEscalation. The finding highlights pods where any container permits processes to gain extra privileges; pods whose containers set allowPrivilegeEscalation: false are noted as not allowing escalation.

Prowler logoProwlerprowler-provider-kubernetes

Risk

Allowing privilege escalation lets processes acquire elevated rights, undermining container isolation. Attackers can abuse setuid paths and capabilities to tamper with workloads (integrity), read sensitive data (confidentiality), pivot within the cluster, or disrupt services (availability).

Run this check with Prowler

Run in Prowler Cloud
Run
prowler kubernetes --checks core_minimize_allowPrivilegeEscalation_containers

Recommendation

Set allowPrivilegeEscalation: false by default and apply least privilege:

  • run as non-root; drop caps (drop: ["ALL"])
  • avoid privileged; use readOnlyRootFilesystem
  • enforce via namespace admission policies (e.g., PSA/OPA) and monitor exceptions

Remediation

Terraform

resource "kubernetes_pod" "main" {
  metadata {
    name = "<example_resource_name>"
  }
  spec {
    container {
      name  = "app"
      image = "nginx"
      security_context {
        allow_privilege_escalation = false # Critical: explicitly disable privilege escalation for the container
      }
    }
  }
}

Other

1Open your Kubernetes Dashboard (or your cloud provider's Kubernetes console) and locate the workload managing the failing Pod (Deployment/StatefulSet/DaemonSet)
2Click Edit to modify the manifest (YAML)
3For each container with securityContext.allowPrivilegeEscalation: true, set it to false (or add allowPrivilegeEscalation: false under securityContext)
4Save/Apply the changes to trigger a rollout
5Verify new Pods have securityContext.allowPrivilegeEscalation set to false

Check Code

from prowler.lib.check.models import Check, Check_Report_Kubernetes
from prowler.providers.kubernetes.services.core.core_client import core_client


class core_minimize_allowPrivilegeEscalation_containers(Check):
    def execute(self) -> Check_Report_Kubernetes:
        findings = []
        for pod in core_client.pods.values():
            report = Check_Report_Kubernetes(metadata=self.metadata(), resource=pod)
            report.status = "PASS"
            report.status_extended = (
                f"Pod {pod.name} does not allow for privilege escalation."
            )

            for container in pod.containers.values():
                if (
                    container.security_context
                    and container.security_context["allow_privilege_escalation"]
                ):
                    report.status = "FAIL"
                    report.status_extended = f"Pod {pod.name} allows privilege escalation in container {container.name}."
                    break

            findings.append(report)

        return findings

References