Kubernetes Privilege Escalation

This record currently combines three distinct Kubernetes API behaviors: listing cluster-wide role bindings, reading Secret data, and creating a ClusterRoleBinding that adds permissions to a ServiceAccount. The binding action can grant broad Kubernetes API access, but does not by itself provide host access or elevate an operating-system process. These steps are not a validated mandatory sequence. The documented procedure requires an authenticated identity and an API endpoint it can reach; Amazon EKS documents public API endpoints, which can be accessed over the Internet when enabled and allowed by its network restrictions, while private endpoints require a connected network.