---

layout: col-sidebar
title: OWASP Kubernetes Top Ten
tags: kubernetes
level: 2
type: 
pitch: Welcome to the OWASP Top Ten for Kubernetes

---
## About the Kubernetes Top 10

When adopting [Kubernetes](https://kubernetes.io), we introduce new risks to our applications and infrastructure. The *OWASP Kubernetes Top 10* is aimed at helping security practitioners, system administrators, and software developers prioritize risks around the Kubernetes ecosystem. The Top Ten is a prioritized list of these risks. In the future we hope for this to be backed by data collected from organizations varying in maturity and complexity.

## Top 10 Kubernetes Risks - 2025

2025 Top 10 Risks now available Feedback welcome. Please open issues or PRs for changes

- [K01: Insecure Workload Configurations](./2025/en/src/K01-Insecure-Workload-Configurations.md)
- [K02: Overly Permissive Authorization Configurations](./2025/en/src/K02-Overly-Permissive-Authorization-Configurations.md)
- [K03: Secrets Management Failures](./2025/en/src/K03-Secrets-Management-Failures.md)
- [K04: Lack Of Cluster Level Policy Enforcement](./2025/en/src/K04-Lack-Of-Cluster-Level-Policy-Enforcement.md)
- [K05: Missing Network Segmentation Controls](./2025/en/src/K05-Missing-Network-Segmentation-Controls.md)
- [K06: Overly Exposed Kubernetes Components](./2025/en/src/K06-Overly-Exposed-Kubernetes-Components.md)
- [K07: Misconfigured And Vulnerable Cluster Components](./2025/en/src/K07-Misconfigured-And-Vulnerable-Cluster-Components.md)
- [K08: Cluster To Cloud Lateral Movement](./2025/en/src/K08-Cluster-To-Cloud-Lateral-Movement.md)
- [K09: Broken Authentication Mechanisms](./2025/en/src/K09-Broken-Authentication-Mechanisms.md)
- [K10: Inadequate Logging And Monitoring](./2025/en/src/K10-Inadequate-Logging-And-Monitoring.md)

## Top 10 Kubernetes Risks - 2022

- [K00: Welcome to the Kubernetes Security Top Ten](./2022/en/src/)
- [K01: Insecure Workload Configurations](./2022/en/src/K01-insecure-workload-configurations)
- [K02: Supply Chain Vulnerabilities](./2022/en/src/K02-supply-chain-vulnerabilities)
- [K03: Overly Permissive RBAC Configurations](./2022/en/src/K03-overly-permissive-rbac)
- [K04: Lack of Centralized Policy Enforcement](./2022/en/src/K04-policy-enforcement)
- [K05: Inadequate Logging and Monitoring](./2022/en/src/K05-inadequate-logging)
- [K06: Broken Authentication Mechanisms](./2022/en/src/K06-broken-authentication)
- [K07: Missing Network Segmentation Controls](./2022/en/src/K07-network-segmentation)
- [K08: Secrets Management Failures](./2022/en/src/K08-secrets-management)
- [K09: Misconfigured Cluster Components](./2022/en/src/K09-misconfigured-cluster-components)
- [K10: Outdated and Vulnerable Kubernetes Components](./2022/en/src/K10-vulnerable-components)
- [Other Risks to Consider](./2022/en/src/other-risks)

## Getting Involved

Development, issues, and discussion all take place on the OWASP Kubernetes Top Ten [GitHub](https://github.com/OWASP/www-project-kubernetes-top-ten) repository. Join the conversation!

## Licensing

The Kubernetes OWASP Top 10 document is licensed under the CC BY-NC-SA 4.0, the Creative Commons Attribution-ShareAlike 4.0 license. Some rights reserved.

## Project Leaders

- [Rory McCune, Senior Security Researcher & Advocate at Datadog](https://www.mccune.org.uk)
- [Cailyn Edwards, Senior Software Engineer, Cloud Security, @ Auth0 by Okta](https://www.cailyncodes.dev)
- **Emeritus** - [Jimmy Mesta, Co-founder & CTO at KSOC](https://twitter.com/jimmesta)