RBAC Misconfiguration in EKS Lets Attackers Hijack Kubernetes Webhooks

A security analysis highlights how overly broad RBAC permissions on Kubernetes admission webhooks can give attackers near-total control over a cluster. Mutating webhooks intercept every API call before it is committed, allowing malicious actors to inject sidecars, alter pod specs, or exfiltrate data silently. The vulnerability typically arises when operators like Argo CD or Cert Manager are granted unrestricted write access to MutatingWebhookConfigurations, rather than being scoped to a specific named resource. An attacker who compromises any workload with access to the operator's ServiceAccount token can inherit these permissions and register their own webhook. Setting failurePolicy to Ignore further conceals the attack, as the webhook remains invisible during downtime while staying silently active during normal cluster operation.