Overviewkubernetes-agent
ghcr.io/pluralsh/kubernetes-agent:0.12.47@sha256:9dfec47ad37d98a332e147c5886e88fe8f235c0725e174f6d6e19387f8fcbd05
Severity breakdown
Critical
0
High
0
Medium
0
Low
3
Unknown
1
Fixable
3/4
Scanned Sep 23, 2026, 7:11 PM UTC
Actual infrastructure risk
Package finding only; applicability requires a demonstrated path. KAS is Internet-accessible through NGINX/TLS at /api:8000 and /ext/kas:8180, with host /k8s-proxy:8154; it runs UID 65532 and does not automount a service-account token. Upstream apiserver TLS verification and CSRF protection are disabled.