Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
DataDog/datadog-operator
main @ 86ad758
33
Fixes
0
CVEs
CRITICAL
Peak severity
50.0%
Coverage
Highlights
Privilege Escalation: 8 prior fixes. Scrutinize any change in this area.
controllers/datadogagent/clusteragent.go: most-fixed (5 issues). Treat as high-risk during review.
18 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Privilege Escalation: The most frequent and severe risk: multiple fixes address overly broad RBAC rules on sensitive resources (clusterroles, secrets, services) and misplaced permissions (e.g., self_enroll secret in ClusterRole). A compromised operator or cluster agent with these grants could escalate to cluster admin.
Authorization Bypass: Multiple fixes prevent unauthorized access or deletion. Issues include using wrong ServiceAccount in bindings, skipping reconciliation of stale ClusterRoleBindings, and deleting resources without owner-reference checks. These can allow an attacker to gain elevated cluster access or cause resource disruption.
AuthBypass: Fixes remove unnecessary RBAC permissions (e.g., Get on VPA, cluster-wide access from cspm) and gate kubelet permissions behind an annotation. Overly permissive default RBAC can lead to unauthorized node introspection or information disclosure.