Description

Detects when Kubernetes containers or pods are configured with hostNetwork=true, which gives containers direct access to the host's network namespace. This configuration bypasses typical network isolation and container networking, potentially allowing containers to sniff network traffic or access restricted network services on the host.

Detection Strategy

• Examines Kubernetes resource definition files (like pod specs, deployments, etc)

• Identifies configuration blocks that set hostNetwork field to true or equivalent values

• Reports a vulnerability when containers/pods are configured to use the host network namespace

Vulnerable code example

apiVersion: v1
kind: Pod
metadata:
  name: vulnerable-pod
spec:
  hostNetwork: true  # Vulnerable: Gives pod access to host network namespace
  containers:
    - name: container...

✅ Secure code example

apiVersion: v1
kind: Pod
metadata:
  name: secure-pod
  labels:
    app: nginx
spec:
  # Removed hostNetwork: true to prevent host network access...