The description above is MITRE’s definition of CWE-668 in CWE 4.20, a class-level weakness.
Common consequences MITRE lists
- Confidentiality: Read Application Data
- Integrity: Modify Application Data
- Other: Varies by Context
Closest guides
These guides cover the nearest controls and techniques; use them with the references below.
Prove network and admission policies enforce the intended boundary
Verify allowed traffic and rejected deployments in the cluster instead of treating policy files as evidence of isolation.
Run Kubernetes workloads with only the privileges they need
Review pod settings, service accounts and effective permissions together before treating a namespace as an isolation boundary.
Ship without debug modes, verbose errors or exposed files
Turn off debug output, publish an allowlisted build and probe each deployment for exposed files and endpoints.
Practice
- Privileged container lab: Reject a privileged workload before deployment · Browser lab
- NetworkPolicy lab: Lock down a shop namespace · Browser lab
- Verify Kubernetes admission and network boundaries · Local project
References
This page is generated from MITRE’s CWE 4.20 catalogue (released 30 April 2026) and lists every guide, fix card and lab here that cites CWE-668.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.