A critical privilege escalation vulnerability in Kubernetes Role-Based Access Control (RBAC) has been discovered that allows authenticated users to escape namespace boundaries and access resources in other namespaces. The vulnerability affects default RBAC configurations in Kubernetes clusters.
All three major cloud providers — Google Cloud (GKE), Microsoft Azure (AKS), and Amazon Web Services (EKS) — have released patches for their managed Kubernetes services. The vulnerability (tracked as CVE-2026-3381) carries a CVSS score of 8.6 and is considered easily exploitable by users with limited cluster access.
Security teams are advised to audit RBAC configurations, apply patches immediately, and implement network policies as a defense-in-depth measure. The discovery has prompted renewed calls for improved default security configurations in Kubernetes distributions.