Inside Job: Defending Kubernetes Clusters Against Network Misconfigurations#

Jacopo Bufalino (Aalto University, CNAM); Jose Luis Martin Navarro (Aalto University, Universitat Politècnica de València); Mario Di Francesco; Tuomas Aura (Aalto University)

• Why: K8s network policy and cluster networking config is a real, underserved attack surface — most K8s security work targets the API server or supply chain, not the network configuration enabling lateral movement. This is an empirical study of that gap at real-organization scale.
• What: A comprehensive analysis of network misconfigurations in Kubernetes deployments, focused on lateral movement risk. The authors evaluated 287 open-source applications from six organizations and found 634 misconfigurations, "well beyond" what state-of-the-art tooling catches; 30+ applications have already been fixed with their proposed mitigations after responsible disclosure (from abstract only).
• How: Methodology is the core: systematic auditing of cluster network configuration (policies, exposure, connectivity grants) against lateral-movement attack paths, with severity assessment discussed directly with the affected organizations.
• Where applicable: Broadly applicable to anyone running multi-tenant Kubernetes — the findings come from open-source production deployments across IT companies, public entities, and non-profits, not a lab cluster. Useful both as a defensive checklist and as evidence for policy-as-code investment.