Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
kubernetes/api
master @ 99eb51d
36
Fixes
0
CVEs
HIGH
Peak severity
76.5%
Coverage
Highlights
Auth Bypass: 19 prior fixes. Scrutinize any change in this area.
pkg/api/validation/validation.go: most-fixed (14 issues). Treat as high-risk during review.
30 high-severity fixes in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Auth Bypass: Multiple fixes in RBAC policy comparison logic (wildcard matching, verb breakdown) show a history of incorrect coverage checks that could allow broader permissions than intended, leading to authorization bypass.
Auth Bypass: RoleBinding references (RoleRef, Subject) had missing required field validation, allowing empty names/kinds that could bypass authorization checks.
Auth Bypass: Multiple validation gaps allowed unauthorized mutation of security-critical fields (mirror pod annotation, PodCIDR, namespace finalizers, PVC spec), all fixed by enforcing immutability or stricter checks.