Description

Detects Kubernetes container specifications that use images without a digest (SHA256 hash). Using container images without digests is insecure as it allows for potential supply chain attacks where the image content could be modified without detection.

Detection Strategy

• Examines container specifications in Kubernetes manifests

• Looks for 'containers' sections that contain 'image' specifications

• Checks if the image reference lacks a digest (SHA256 hash) component

• Reports a vulnerability for any container image specified without a SHA256 digest

Vulnerable code example

apiVersion: v1
kind: Pod
metadata:
  name: vulnerable-pod
spec:
  privileged: true    # Dangerous: Allows privileged mode which bypasses security controls
  containers:
    - name: vuln-container...

✅ Secure code example

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  labels:
    app: web
spec:
  # Remove privileged: true as it's a dangerous security risk...