# OperTraitors: How Kubernetes Operators Betray Your Security Posture

IBM Turbonomic's Prometurbo operator was bound to a ClusterRole granting get/list/watch on all secrets cluster-wide, letting a compromise dump credentials from unrelated namespaces.

- Payout: Research
- Severity: high
- Program: IBM
- Found by (vendor credit): This vulnerability was reported to IBM by Lior Yakim
- Write-up by: Lior Yakim
- Disclosed: 2026-09-29
- CVE: CVE-2026-6389
- Write-up quality: 6/10
- Original: https://unit42.paloaltonetworks.com/agentic-ai-kubernetes-operator-risks/
- Library page: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-agentic-ai-kubernetes-operator-risks
- Tags: area:cloud domain:cloud impact:data-leak impact:internal-access impact:privesc kind:research platform:threat-intel sev:high tech:kubernetes technique:source-review vuln:access-control vuln:misconfiguration vuln:secrets-leak

**Target:** Kubernetes operator service account / ClusterRole RBAC
**Root cause:** The Prometurbo operator's service account was bound to a ClusterRole containing an explicit rule granting get, list and watch on the secrets resource in the core API group, instead of being scoped to its own namespace.
**Steps:**
1. Scan OperatorHub and local operator manifests with OperTraitor, extracting raw YAML RBAC configs
2. Flag Prometurbo operator for wildcard/excessive permissions; note OperatorHub version is outdated v8.6.0 (2022)
3. Analyze current version from IBM GitHub repo (v8.17.6)
4. Observe service account bound to a ClusterRole with rule `apiGroups: [""]`, resources secrets, verbs get/list/watch
5. Confirm cluster-wide secret read exceeds documented operator functionality
**How found:** OperTraitor compared each operator's documented functionality against its actual granted RBAC, scoring the gap; Prometurbo's wildcard usage triggered a flag, and reviewing the newer GitHub version confirmed the ClusterRole secret rule persisted.
**Exploitation:** If the operator is compromised (supply chain, dependency vuln, node hijack), the attacker inherits its service account and can list/read secrets across all namespaces, dumping admin service account tokens, DB credentials, API keys and TLS certs.
**Escalation:** Cluster-wide secret read turns a localized operator compromise into full environment compromise via harvested admin tokens and credentials from unrelated namespaces.
**Insight:** Diff an operator's documented function against its ClusterRole verbs — a single get/list/watch on secrets at cluster scope is a credential-harvesting backdoor even in the latest release, and OperatorHub often lags the vendor's patched Helm/GitHub version.