The OWASP Kubernetes Top 10 ranks the risks of running applications on Kubernetes, from workload settings to the cloud account around the cluster. The 2025 edition, published in March 2026, follows the 2022 list and renumbers most of it; each page gives the 2022 entry with the same subject, and says where this site has no guide yet.
| Risk | Summary | 2022 entry | Guides here |
|---|---|---|---|
| K01:2025 Insecure Workload Configurations | Pods run with Kubernetes and container runtime defaults that are not hardened for production: root users, default capabilities, mounted service account tokens, no seccomp filter, no resource limits, or privileged and host-namespace settings. | K01:2022 | 3 |
| K02:2025 Overly Permissive Authorization Configurations | RBAC and other authorizers grant people and services more than they need: cluster-admin, broad built-in roles, list or watch on Secrets, node proxy rights, escalate, bind or impersonate verbs, and wide roles installed by third-party charts and operators. | K03:2022 | 3 |
| K03:2025 Secrets Management Failures | Credentials end up where they are easy to read or hard to rotate: baked into images, stored in ConfigMaps, passed as environment variables, committed to repositories, written to logs, or readable by anyone with list or watch on Secrets. | K08:2022 | 3 |
| K04:2025 Lack Of Cluster Level Policy Enforcement | Nothing in the cluster rejects a non-compliant resource, so privileged pods, images from untrusted registries, public exposure and spoofed labels get through whenever a review or pipeline check is skipped. | K04:2022 | 5 |
| K05:2025 Missing Network Segmentation Controls | Every pod can reach every other pod, the control plane, node services and the internet, so one compromised workload can probe the whole cluster and exfiltrate data. | K07:2022 | 1 |
| K06:2025 Overly Exposed Kubernetes Components | The API server, and sometimes the kubelet or etcd, can be reached from the internet, so leaked credentials work from anywhere and unauthenticated endpoints reveal the exact version and internal addresses. | New | 1 |
| K07:2025 Misconfigured And Vulnerable Cluster Components | Control-plane components, nodes and the container runtime run with unhardened defaults or unpatched vulnerabilities, giving attackers an easier first foothold or a way to escalate. | K09:2022, K10:2022 | 2 |
| K08:2025 Cluster To Cloud Lateral Movement | A compromised pod uses the cloud permissions around it, the node's IAM role through the metadata service or static cloud keys stored in the cluster, to reach storage, databases and other resources in the cloud account. | New | 3 |
| K09:2025 Broken Authentication Mechanisms | People and services authenticate to the API with weak or unmanageable credentials: long-lived client certificates that cannot be revoked, static service account tokens used outside the cluster, anonymous access and default service account tokens. | K06:2022 | 2 |
| K10:2025 Inadequate Logging And Monitoring | Audit logging is off or not retained, and node and workload logs are not collected, so attacker activity goes unseen and incidents cannot be reconstructed. | K05:2022 | 2 |
Entries from OWASP Kubernetes Top 10: Top 10 Kubernetes Risks - 2025. “Guides here” counts the guides whose main subject is the entry or that cover it in a dedicated section.