# GHSA-jhjp-4c2q-xmx4: k8saudit shipped rules do not detect privileged/sensitive settings on init or ephemeral containers

> GHSA-jhjp-4c2q-xmx4 is a medium-severity vulnerability with a CVSS 3.1 base score of 4.3, classed as Protection Mechanism Failure (CWE-693), in 5 packages, including github.com/falcosecurity/plugins/plugins/k8saudit (Go) and github.com/falcosecurity/plugins/plugins/k8saudit-eks (Go). Fixed versions: github.com/falcosecurity/plugins/plugins/k8saudit 0.18.0; github.com/falcosecurity/plugins/plugins/k8saudit-eks 0.12.0; and 3 more packages.

Canonical page: https://cveminer.com/vulnerabilities/GHSA-jhjp-4c2q-xmx4

| Field | Value |
| --- | --- |
| GHSA | GHSA-jhjp-4c2q-xmx4 |
| Severity | Medium |
| CVSS 3.1 | 4.3 `CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N` (GitHub Advisory Database) |
| CWE | CWE-693 Protection Mechanism Failure |
| CISA KEV | Not listed |
| Published | 21 Sept 2026 |
| Modified | 21 Sept 2026 |

## Description

The `k8saudit` plugin's per-container fields (`ka.req.pod.containers.*`) and the shipped `k8s_audit_rules.yaml` evaluated only `requestObject.spec.containers`. Security-relevant settings on a pod's `initContainers` or `ephemeralContainers` were not inspected, so the shipped `Create Privileged Pod` rule did not fire for a privileged container placed in either list.

##### Impact

An actor able to create pods (the activity k8saudit is intended to audit) could run a privileged container without triggering the default `Create Privileged Pod` rule, by declaring it as an `initContainer` or `ephemeralContainer` instead of a regular container. Kubernetes runs such containers with the requested privileges, but the shipped rule did not see them. The same gap applied to other per-container security settings (capabilities, `allowPrivilegeEscalation`, `runAsUser`, etc.) and, for deployments using a customized image allowlist, to disallowed images placed in those lists.

This is a detection bypass of the default k8saudit ruleset, not a direct privilege escalation, and it requires the ability to create pods. The cloud-provider variants (`k8saudit-eks`, `k8saudit-gke`, `k8saudit-aks`, `k8saudit-ovh`) embed the same extraction logic and ship the same ruleset, and were affected equally.

Note: adding an ephemeral container goes through the `pods/ephemeralcontainers` subresource, so the `EphemeralContainers Created` rule still logged that event at `NOTICE`, but without any privileged/security evaluation.


##### Patches

Fixed in `k8saudit 0.18.0`, and in the cloud-variant releases that depend on it — `k8saudit-eks 0.12.0`, `k8saudit-gke 0.9.0`, `k8saudit-aks 0.6.0`, `k8saudit-ovh 0.6.0` — all released on 2026-06-19.

The fix ([falcosecurity/plugins#1400](https://github.com/falcosecurity/plugins/pull/1400), merged 2026-06-18) adds dedicated `ka.req.pod.initContainers.*` and `ka.req.pod.ephemeralContainers.*` field families and updates `Create Privileged Pod` (via a new `any_container_privileged` macro) to evaluate all three container lists.

Operators upgrading should review any **custom** rules built on `ka.req.pod.containers.*` — in particular tuned `Create Disallowed Pod` image allowlists — and extend them to the new `initContainers`/`ephemeralContainers` image fields.

##### Workarounds

For deployments that cannot upgrade immediately, restrict who can create pods (RBAC) and enforce Pod Security Admission (`baseline`/`restricted`) or an admission controller (Kyverno, OPA/Gatekeeper) to block privileged init/ephemeral containers at admission time, as defense-in-depth.

##### Credits

[kanywst](https://github.com/kanywst) — discovery and fix.

## Affected packages

| Package | Ecosystem | PURL | Vulnerable versions | Fixed in |
| --- | --- | --- | --- | --- |
| github.com/falcosecurity/plugins/plugins/k8saudit | Go | `pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit` | <= 0.17.0 | 0.18.0 |
| github.com/falcosecurity/plugins/plugins/k8saudit-eks | Go | `pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit-eks` | <= 0.11.0 | 0.12.0 |
| github.com/falcosecurity/plugins/plugins/k8saudit-gke | Go | `pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit-gke` | <= 0.8.0 | 0.9.0 |
| github.com/falcosecurity/plugins/plugins/k8saudit-aks | Go | `pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit-aks` | <= 0.5.1 | 0.6.0 |
| github.com/falcosecurity/plugins/plugins/k8saudit-ovh | Go | `pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit-ovh` | <= 0.5.0 | 0.6.0 |

## Fix commits

- Patch: https://github.com/falcosecurity/plugins/commit/0adb9b3c7e2c8bad53f30d01c057e038b2afa5e1
- Pull request: https://github.com/falcosecurity/plugins/pull/1400

## Questions

**Does GHSA-jhjp-4c2q-xmx4 have a CVE ID?**

No CVE ID has been assigned to GHSA-jhjp-4c2q-xmx4 yet. It is tracked only as a GitHub advisory.

**What is the CVSS score of GHSA-jhjp-4c2q-xmx4?**

GHSA-jhjp-4c2q-xmx4 has a CVSS 3.1 base score of 4.3 (Medium), vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N.

**Which versions are affected by GHSA-jhjp-4c2q-xmx4?**

github.com/falcosecurity/plugins/plugins/k8saudit (Go): <= 0.17.0. github.com/falcosecurity/plugins/plugins/k8saudit-eks (Go): <= 0.11.0. github.com/falcosecurity/plugins/plugins/k8saudit-gke (Go): <= 0.8.0. github.com/falcosecurity/plugins/plugins/k8saudit-aks (Go): <= 0.5.1. github.com/falcosecurity/plugins/plugins/k8saudit-ovh (Go): <= 0.5.0.

**How do I fix GHSA-jhjp-4c2q-xmx4?**

Upgrade each package to its fixed version: github.com/falcosecurity/plugins/plugins/k8saudit 0.18.0; github.com/falcosecurity/plugins/plugins/k8saudit-eks 0.12.0; github.com/falcosecurity/plugins/plugins/k8saudit-gke 0.9.0; github.com/falcosecurity/plugins/plugins/k8saudit-aks 0.6.0; and 1 more packages. The fix is in commit 0adb9b3 and pull request #1400.

**What is the Package URL (PURL) for GHSA-jhjp-4c2q-xmx4?**

The affected packages' PURLs are pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit, pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit-eks, pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit-gke, pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit-aks and pkg:golang/github.com/falcosecurity/plugins/plugins/k8saudit-ovh.

## References

- https://github.com/falcosecurity/plugins/pull/1400 (fix)
- https://github.com/falcosecurity/plugins/commit/0adb9b3c7e2c8bad53f30d01c057e038b2afa5e1 (fix)
- https://github.com/falcosecurity/plugins/security/advisories/GHSA-jhjp-4c2q-xmx4 (advisory)
- https://github.com/advisories/GHSA-jhjp-4c2q-xmx4 (advisory)
- https://github.com/falcosecurity/plugins (package)
- https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-aks/v0.6.0
- https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-eks/v0.12.0
- https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-gke/v0.9.0
- https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit-ovh/v0.6.0
- https://github.com/falcosecurity/plugins/releases/tag/plugins/k8saudit/v0.18.0

---

Source: CVEminer (https://cveminer.com/vulnerabilities/GHSA-jhjp-4c2q-xmx4), compiled from OSV (GitHub advisory), GitHub Advisory Database. OSV and GitHub Advisory Database content is licensed CC BY 4.0.