![OWASP Logo](https://owasp.org/assets/images/logo.png)

# [OWASP Kubernetes Top 10](https://owasp.org/www-project-kubernetes-top-ten/)

## About the Kubernetes Top 10

When adopting [Kubernetes](https://kubernetes.io), we introduce new risks to our applications and infrastructure. The *OWASP Kubernetes Top 10* is aimed at helping security practitioners, system administrators, and software developers prioritize risks around the Kubernetes ecosystem. The Top Ten is a prioritized list of these risks. In the future we hope for this to be backed by data collected from organizations varying in maturity and complexity.

## Top 10 Kubernetes Risks - 2025

2025 Top 10 Risks now available Feedback welcome. Please open issues or PRs for changes

- [K01: Insecure Workload Configurations](./2025/en/src/K01-Insecure-Workload-Configurations.md)
- [K02: Overly Permissive Authorization Configurations](./2025/en/src/K02-Overly-Permissive-Authorization-Configurations.md)
- [K03: Secrets Management Failures](./2025/en/src/K03-Secrets-Management-Failures.md)
- [K04: Lack Of Cluster Level Policy Enforcement](./2025/en/src/K04-Lack-Of-Cluster-Level-Policy-Enforcement.md)
- [K05: Missing Network Segmentation Controls](./2025/en/src/K05-Missing-Network-Segmentation-Controls.md)
- [K06: Overly Exposed Kubernetes Components](./2025/en/src/K06-Overly-Exposed-Kubernetes-Components.md)
- [K07: Misconfigured And Vulnerable Cluster Components](./2025/en/src/K07-Misconfigured-And-Vulnerable-Cluster-Components.md)
- [K08: Cluster To Cloud Lateral Movement](./2025/en/src/K08-Cluster-To-Cloud-Lateral-Movement.md)
- [K09: Broken Authentication Mechanisms](./2025/en/src/K09-Broken-Authentication-Mechanisms.md)
- [K10: Inadequate Logging And Monitoring](./2025/en/src/K10-Inadequate-Logging-And-Monitoring.md)


### Top 10 Kubernetes Risks - 2022

* K00:2022 [Welcome to the Kubernetes Security Top Ten](2022/en/src/K00-introduction.md)
* K01:2022 [Insecure Workload Configurations](2022/en/src/K01-insecure-workload-configurations.md)
* K02:2022 [Supply Chain Vulnerabilities](2022/en/src/K02-supply-chain-vulnerabilities.md)
* K03:2022 [Overly Permissive RBAC Configurations](2022/en/src/K03-overly-permissive-rbac.md)
* K04:2022 [Lack of Centralized Policy Enforcement](2022/en/src/K04-policy-enforcement.md)
* K05:2022 [Inadequate Logging and Monitoring](2022/en/src/K05-inadequate-logging.md)
* K06:2022 [Broken Authentication Mechanisms](2022/en/src/K06-broken-authentication.md)
* K07:2022 [Missing Network Segmentation Controls](2022/en/src/K07-network-segmentation.md)
* K08:2022 [Secrets Management Failures](2022/en/src/K08-secrets-management.md)
* K09:2022 [Misconfigured Cluster Components](2022/en/src/K09-misconfigured-cluster-components.md)
* K10:2022 [Outdated and Vulnerable Kubernetes Components](2022/en/src/K10-vulnerable-components.md)
* [Other Risks to Consider](2022/en/src/other-risks.md)


## Get Involved!

Development of this document take place within the source repository on [GitHub](https://github.com/OWASP/www-project-kubernetes-top-ten).

* We are actively looking for organizations and individuals that will provide Kubernetes vulnerability and misconfiguration data.
* Translation efforts
* Assisting in the development of related tools and projects
  - [OWASP Kubernetes Security Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Kubernetes_Security_Cheat_Sheet.html)
  - [OWASP Kubernetes Security Testing Guide](https://github.com/owasp/www-project-kubernetes-security-testing-guide)
  - [OWASP Docker Security Cheatsheet](https://cheatsheetseries.owasp.org/cheatsheets/Docker_Security_Cheat_Sheet.html)


[Slack](https://owasp.slack.com): [#project-k8s-top10](https://owasp.slack.com/messages/project-k8s-top10) channel