trivy-operator

Kubernetes-native security toolkit. Documentation Introduction The Trivy Operator leverages Trivy to continuously scan your Kubernetes cluster for security issues. The scans are summarised in security reports as Kubernetes Custom Resource Definitions, which become accessible through the Kubernete...

red-kube

Red Team K8S Adversary Emulation Based on kubectl Red Kube is a collection of kubectl commands written to evaluate the security posture of Kubernetes clusters from the attacker's perspective. The commands are either passive for data collection and information disclosure or active for performing...

kube-monkey

kube-monkey kube-monkey is an implementation of Netflix's Chaos Monkey for Kubernetes clusters. It randomly deletes pods in the cluster, encouraging and validating the development of failure-resilient services. Apps opt in with a label, terminations happen during the hours and days you pick, and...

POC-2020-8558

Overview CVE-2020-8558 is a Kubernetes venerability which was published because kube-proxy unexpectedly makes localhost-bound host services available to others on the network. I place the emphasis on unexpectedly because this vulnerability is due to a design flaw oversight, not an implementation...

Copy-Fail-CVE-2026-31431-Kubernetes-PoC

Copy Fail CVE-2026-31431 — Kubernetes Container Escape PoC A proof-of-concept demonstrating how a fully unprivileged container can achieve node-level code execution on Kubernetes by exploiting the CVE-2026-31431 Linux kernel page-cache corruption bug through shared container image layers. The cor...

kube-bench

kube-bench is a tool that checks whether Kubernetes is deployed securely by running the checks documented in the CIS Kubernetes Benchmark. Tests are configured with YAML files, making this tool easy to update as test specifications evolve. CIS Scanning as part of Trivy and the Trivy Operator Triv...

CVE-2018-1002105

CMPT733-Group110x90 CVE-2018-1002105 Members : Abhishek Rungta, Shubham Saini, Siddhant Sood Environment Setup A linux VM Such as Ubuntu 20.04 Minikube for local deploymnet of kubernetes Any of these older versions1.0.x— 1.9.x, 1.10.0—1.10.10,1.11.0—1.11.4,1.12.0—1.12.2 Run the exploit We have...

kube-knark

Kube-Knark Project Trace your kubernetes runtime !! Kube-Knark is an open-source tracer that uses pcap & ebpf technology to perform runtime tracing on a deployed Kubernetes cluster. It is tracing the Kubernetes API execution and master node configuration files permission changes. The trace matchi...

kube-linter

Static analysis for Kubernetes What is KubeLinter? KubeLinter analyzes Kubernetes YAML files, Helm charts, and Kustomize manifests, and checks them against a variety of best practices, with a focus on production readiness and security. KubeLinter runs sensible default checks, designed to give you...

kube-dementor

Kube-Dementor — Kubernetes Attack Graph Analyzer Kubernetes s...

kube-score

kube-score kube-score es una herramienta que realiza análisis estático de código de sus definiciones de objetos de Kubernetes. La salida es una lista de recomendaciones sobre lo que puede mejorar para hacer su aplicación más segura y resistente. Puede probar kube-score en el navegador con la demo...

kube-hunter

Notice kube-hunter is not under active development anymore. If you're interested in scanning Kubernetes clusters for known vulnerabilities, we recommend using Trivy. Specifically, Trivy's Kubernetes misconfiguration scanning and KBOM vulnerability scanning. Learn more in the Trivy Docs. kube-hunt...

kube-reaper

kube-reaper Kubernetes RBAC attack path mapper. It finds what your identity can do, flags dangerous permissions, and chains them into multi-step paths to cluster compromise. Built for red teamers and penetration testers. What It Does kube-reaper scans a Kubernetes cluster from any identity user,...

CLEANSTART-2026-RX78395 Security fix for ghsa-gcjh-h69q-9w9g applied in: kube-state-metrics-fips 2.20.0-r3, eks-distro-kube-scheduler 1.36.9-r2, eks-distro-kube-controller-manager-fips 1.36.8-r0, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

ghsa-gcjh-h69q-9w9g affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CD04274 Security fix for ghsa-hrxh-6v49-42gf applied in: aws-network-policy-agent 1.2.7-r0, fabric-peer 3.1.5-r1, gotenberg 8.33.0-r0, step 0.30.2-r4, kube-state-metrics-fips 2.20.0-r4, eks-distro-kube-apiserver 1.36.8-r0, eks-distro-kube-apiserver-fips 1.36.8-r0

ghsa-hrxh-6v49-42gf affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-ZS73776 Security fix for ghsa-8wmf-6v46-5gfg applied in: eks-distro-kube-scheduler-fips 1.35.14-r0, eks-distro-kube-controller-manager-fips 1.36.8-r1, eks-distro-kube-apiserver 1.36.8-r2, eks-distro-kube-apiserver-fips 1.36.8-r1

ghsa-8wmf-6v46-5gfg affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QF95955 gRPC-Go is the Go language implementation of gRPC

Security vulnerability affects the kube-state-metrics-fips package. gRPC-Go is the Go language implementation of gRPC...

kube-beacon

Kube-Beacon Project Scan your kubernetes runtime !! Kube-Beacon is an open source audit scanner who perform audit check on a deployed kubernetes cluster and output a security report. The audit tests are the full implementation of CIS Kubernetes Benchmark specification NEW !! audit result now can ...

kube-alien

Kube-alien This tool launches attack on k8s cluster from within. That means you already need to have an access with permission to deploy pods in a cluster to run it. After running the kube-alien pod it tries to takeover cluster's nodes by adding your public key to node's /root/.ssh/authorizedkeys...

kube-alien

Kube-alien Esta herramienta lanza ataques a un clúster de k8s desde dentro. Esto significa que ya necesitas tener acceso con permisos para desplegar pods en un clúster para ejecutarlo. Después de ejecutar el pod kube-alien, intenta tomar el control de los nodos del clúster añadiendo tu clave...