Shared Surface · Operators
Operators & DaemonSets
Operators and DaemonSets run powerful, shared code on behalf of every tenant. That makes them classic confused deputies — trusted components that can be tricked into acting on an attacker's behalf.
Operators are widely used in most Kubernetes clusters to provide additional features and functionalities to users of the cluster. In a Multi-tenant environment though, they can present risks of privilege escalation.
Another similar risk can be presented by daemonsets which are often used to provide system or cluster-wide functionality.
Node Privilege Escalation
The first risk presented by these features is that, they often run with quite high privileges in the cluster, and as such present a tempting target for attackers who have managed to break out of a container and on to the underlying node. This could be in the form of service account tokens used by operators (many run as cluster-admin) or APIs used by those applications which can be abused by an attacker.
Confused deputies
Another risk is that an operator which provides services to tenants can be abused as a “confused deputy” to allow a malicious tenant to escalate their privileges in a cluster. This is an area that’s being actively researched by a number of groups at the moment (2026), and we’re seeing quite a few examples of operators that can be attacked like this (see references for more information)