--- title: OWASP Top 10 Kubernetes Security Risks Explained | daily.dev description: The OWASP Kubernetes Top 10 lists ten categories of risk, from insecure workload configs to broken authentication, with K03 (Secrets Management Failures) noted... canonical: https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: OWASP Top 10 Kubernetes Security Risks Explained | daily.dev og:description: The OWASP Kubernetes Top 10 lists ten categories of risk, from insecure workload configs to broken authentication, with K03 (Secrets Management Failures) noted... og:url: https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq og:image: https://api.daily.dev/og/posts/cp48vMlpq.png og:image:alt: OWASP Top 10 Kubernetes Security Risks Explained og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # OWASP Top 10 Kubernetes Security Risks Explained **[GitGuardian](https://daily.dev/sources/gitguardian)** · 15 min read · 5 upvotes · 2 comments ## Summary The OWASP Kubernetes Top 10 lists ten categories of risk, from insecure workload configs to broken authentication, with K03 (Secrets Management Failures) noted because one leaked credential can unlock a chain of others. GitGuardian researchers found 44 active Kubernetes clusters reachable through leaked secrets, 30% of which had been exposed for more than two years, with the oldest dating to 2021. The GhostAction supply chain campaign targeted 2,577 secret values across 772 repositories, and a separate leak exposed 844 MB of plaintext CISA credentials including AWS tokens and Terraform code. Recommended fixes include strict RBAC, short-lived workload identities, and scanning repos, images and pipelines for secrets. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How many Kubernetes clusters were found accessible through leaked secrets in GitGuardian's research? GitGuardian researchers identified 44 active Kubernetes clusters accessible through leaked secrets. Four of those clusters had more than 10 nodes and one exceeded 200 nodes. Thirty percent of the accessible clusters had been exposed for more than two years, with the oldest valid leak dating back to 2021. _Teams auditing their own cluster exposure can track similar credential leak research on daily.dev._ ### What is the GhostAction supply chain attack and how many secrets did it target? GhostAction was a supply chain campaign that targeted 2,577 secret values across 772 public repositories, running between August 31 and September 30, 2026. It targeted credentials used by automation, including cloud keys and container registry credentials. A later wave in October affected another 346 repositories with confirmed successful exfiltration. _Anyone hardening CI/CD pipelines against credential theft can follow supply chain attack developments on daily.dev._ ### What are the six common ways secrets get exposed in Kubernetes according to OWASP? OWASP's Kubernetes Top 10 identifies six paths: secrets baked into container images, sensitive values placed in ConfigMaps, secrets passed as environment variables, credentials committed to code repositories, excessive WATCH or LIST access to Secret objects, and secrets written to application logs where they can spread into centralized logging systems. _Developers tightening Kubernetes secrets hygiene can keep up with OWASP guidance like this on daily.dev._ ## Community discussion Top comments from developers on daily.dev. **@pdfopsdev** · 0 upvotes > the secrets stat is the scary one honestly, 44 clusters reachable through leaked creds and a third of those exposed over two years. short lived workload identity kills this whole class outright, rotating static secrets faster never actually closes the window. **@laouadirabah** · 0 upvotes > The hard part with Kubernetes security is that most failures aren’t exotic exploits, they’re boring configuration and trust-boundary mistakes. > > RBAC, secrets handling, workload identity and network policy usually deserve more attention than adding another scanner. ## Similar posts on daily.dev - [Leaked Kubernetes Secrets: Impact Assessment and Mitigation Strategies](https://daily.dev/posts/leaked-kubernetes-secrets-impact-assessment-and-mitigation-strategies-bs3m8i7md) · GitGuardian · 0 upvotes · 0 comments - [Understanding Current Threats to Kubernetes Environments](https://daily.dev/posts/understanding-current-threats-to-kubernetes-environments-fxdltzw1h) · Unit 42 · 1 upvotes · 0 comments - [Best of 2025: Hardening Kubernetes Security with DevSecOps Practices](https://daily.dev/posts/best-of-2025-hardening-kubernetes-security-with-devsecops-practices-js3xw9w1r) · Cloud Native Now · 15 upvotes · 0 comments - [7 Toxic Kubernetes CI/CD Mistakes Ruining Your Weekends](https://daily.dev/posts/7-toxic-kubernetes-ci-cd-mistakes-ruining-your-weekends-40ijlbjeq) · Devtron · 1 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes), [#secrets-management](https://daily.dev/tags/secrets-management), [#gitguardian](https://daily.dev/tags/gitguardian) [View this post on daily.dev](https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"OWASP Top 10 Kubernetes Security Risks Explained","url":"https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq"},"datePublished":"2026-10-26T16:01:08.847Z","dateModified":"2026-10-26T16:01:39.302Z","description":"The OWASP Kubernetes Top 10 lists ten categories of risk, from insecure workload configs to broken authentication, with K03 (Secrets Management Failures) noted...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8580d95e19b125c3b69ee24a1f3509d0?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/8580d95e19b125c3b69ee24a1f3509d0?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"GitGuardian","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"GitGuardian","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/406f3b707b1741f7b988cf561463a54d","url":"https://daily.dev/sources/gitguardian"},"commentCount":2,"discussionUrl":"https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":5},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":2}],"keywords":"security,kubernetes,secrets-management,gitguardian","timeRequired":"PT15M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"GitGuardian","item":"https://daily.dev/sources/gitguardian"},{"@type":"ListItem","position":3,"name":"OWASP Top 10 Kubernetes Security Risks Explained"}]} {"@context":"https://schema.org","@type":"WebPage","@id":"https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq","comment":[{"@type":"Comment","text":"the secrets stat is the scary one honestly, 44 clusters reachable through leaked creds and a third of those exposed over two years. short lived workload identity kills this whole class outright, rotating static secrets faster never actually closes the window.","datePublished":"2026-10-27T18:13:00.665Z","url":"https://daily.dev/posts/cp48vMlpq#c-CXj2MJzhq","author":{"@type":"Person","name":"PDFops","url":"https://daily.dev/pdfopsdev","image":"https://media.daily.dev/image/upload/s---8isRBKc--/f_auto/v1782922291/avatars/avatar_orjMeK8QKaaVZwGq7ScPz?_a=BAMAMicg0"}},{"@type":"Comment","text":"The hard part with Kubernetes security is that most failures aren’t exotic exploits, they’re boring configuration and trust-boundary mistakes.\nRBAC, secrets handling, workload identity and network policy usually deserve more attention than adding another scanner.","datePublished":"2026-10-26T16:09:58.578Z","url":"https://daily.dev/posts/cp48vMlpq#c-lGiv0m1uf","author":{"@type":"Person","name":"Laouadi Rabah","url":"https://daily.dev/laouadirabah","image":"https://avatars.githubusercontent.com/u/297700963?v=4"}}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq#faq","mainEntity":[{"@type":"Question","name":"How many Kubernetes clusters were found accessible through leaked secrets in GitGuardian's research?","acceptedAnswer":{"@type":"Answer","text":"GitGuardian researchers identified 44 active Kubernetes clusters accessible through leaked secrets. Four of those clusters had more than 10 nodes and one exceeded 200 nodes. Thirty percent of the accessible clusters had been exposed for more than two years, with the oldest valid leak dating back to 2021. Teams auditing their own cluster exposure can track similar credential leak research on daily.dev."}},{"@type":"Question","name":"What is the GhostAction supply chain attack and how many secrets did it target?","acceptedAnswer":{"@type":"Answer","text":"GhostAction was a supply chain campaign that targeted 2,577 secret values across 772 public repositories, running between August 31 and September 30, 2026. It targeted credentials used by automation, including cloud keys and container registry credentials. A later wave in October affected another 346 repositories with confirmed successful exfiltration. Anyone hardening CI/CD pipelines against credential theft can follow supply chain attack developments on daily.dev."}},{"@type":"Question","name":"What are the six common ways secrets get exposed in Kubernetes according to OWASP?","acceptedAnswer":{"@type":"Answer","text":"OWASP's Kubernetes Top 10 identifies six paths: secrets baked into container images, sensitive values placed in ConfigMaps, secrets passed as environment variables, credentials committed to code repositories, excessive WATCH or LIST access to Secret objects, and secrets written to application logs where they can spread into centralized logging systems. Developers tightening Kubernetes secrets hygiene can keep up with OWASP guidance like this on daily.dev."}}]} ```