Homepage
About Snyk

Network policy does not restrict egress destinations Affecting Deployment service in Kubernetes

0.0
high
    Severity Framework Snyk CCSS
    Rule category Network / Network

Is your enviroment affected by this misconfiguration?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
    Frameworks
    CIS-Controls
  • Snyk ID SNYK-CC-00628
  • credit Snyk Research Team
Report a new misconfiguration Found a mistake?

Description

Improperly configured egress rules in Kubernetes can enable pods to send network traffic outside the cluster, potentially allowing for unauthorized data exfiltration.

How to fix?

Add specific to attributes to egress rules.

Example Configuration

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: default-deny-all-egress
spec:
  podSelector: {}
  egress:
  - to:
    ports:
    - protocol: TCP
      port: 53
    - protocol: UDP
      port: 53
  policyTypes:
  - Egress