{ "schemaVersion": "catalog-shared-check-receipt-v1", "subject": { "id": "grafana-pyroscope-2-0-2-no-crds", "chart": "grafana/pyroscope", "version": "2.0.2", "base": "no-crds", "renderPath": "recipes/grafana/pyroscope/2.0.2/revisions/no-crds/r001/rendered/release-objects.yaml", "renderFileSHA256": "sha256:bd128b8d66e06802da2e56a74216e817033ebe8ed59abe878df05886ec008086" }, "catalogReview": { "path": "recipes/grafana/pyroscope/2.0.2/revisions/no-crds/r001/receipts/scan-receipt.yaml", "note": "Separate chart-specific Catalog review; not a cub check result." }, "scannerResult": { "schema_version": "risk-scan-findings-v1", "surface": "cub-scan", "finding_count": 10, "findings": [ { "id": "CCVE-2025-3747", "name": "StatefulSet missing security context", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "critical", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "pyroscope-alloy", "namespace": "default" }, "message": "StatefulSet omits pod and container securityContext settings", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set securityContext at pod and container level", "Enforce runAsNonRoot, readOnlyRootFilesystem, and drop ALL capabilities", "Apply a seccomp profile (RuntimeDefault or stricter)" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.securityContext}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set securityContext at pod and container level", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.securityContext}'", "doc_ref": "cub-scan --explain CCVE-2025-3747" } }, { "id": "CCVE-2025-3748", "name": "StatefulSet container does not set runAsNonRoot", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "critical", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "pyroscope-alloy", "namespace": "default" }, "message": "Container alloy does not set runAsNonRoot: true", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set securityContext.runAsNonRoot to true at pod or container level", "Set runAsUser to a non-zero UID", "Ensure container images do not require root" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.securityContext}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set securityContext.runAsNonRoot to true at pod or container level", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.securityContext}'", "doc_ref": "cub-scan --explain CCVE-2025-3748" } }, { "id": "CCVE-2025-3749", "name": "StatefulSet containers omit resource limits", "category": "CONFIG", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "pyroscope", "namespace": "default" }, "message": "StatefulSet containers omit resource limits", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set resources.limits.cpu and resources.limits.memory on every container", "Align limits with observed peak usage plus headroom", "Consider LimitRange policies as a cluster-level safety net" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set resources.limits.cpu and resources.limits.memory on every container", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'", "doc_ref": "cub-scan --explain CCVE-2025-3749" } }, { "id": "CCVE-2025-3749", "name": "StatefulSet containers omit resource limits", "category": "CONFIG", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "pyroscope-alloy", "namespace": "default" }, "message": "StatefulSet containers omit resource limits", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set resources.limits.cpu and resources.limits.memory on every container", "Align limits with observed peak usage plus headroom", "Consider LimitRange policies as a cluster-level safety net" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set resources.limits.cpu and resources.limits.memory on every container", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'", "doc_ref": "cub-scan --explain CCVE-2025-3749" } }, { "id": "CCVE-2025-3750", "name": "StatefulSet containers omit resource requests", "category": "CONFIG", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "pyroscope", "namespace": "default" }, "message": "StatefulSet containers omit resource requests; HPA and scheduler decisions will be unreliable", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set resources.requests.cpu and resources.requests.memory on every container", "Align requests with observed steady-state usage", "Ensure requests are set when using HPA" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'" ] }, "evidence_source": "native", "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set resources.requests.cpu and resources.requests.memory on every container", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.containers[*].resources}'", "doc_ref": "cub-scan --explain CCVE-2025-3750" } }, { "id": "CCVE-2025-3752", "name": "StatefulSet does not disable automountServiceAccountToken", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "pyroscope", "namespace": "default" }, "message": "StatefulSet does not set automountServiceAccountToken: false; pods get unnecessary API credentials", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set automountServiceAccountToken to false in the pod spec", "Only enable it for pods that genuinely need Kubernetes API access", "Use dedicated service accounts with minimal RBAC for pods that need API access" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-RBAC-0002" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set automountServiceAccountToken to false in the pod spec", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'", "doc_ref": "cub-scan --explain CCVE-2025-3752" } }, { "id": "CCVE-2025-3752", "name": "StatefulSet does not disable automountServiceAccountToken", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "warning", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "StatefulSet", "name": "pyroscope-alloy", "namespace": "default" }, "message": "StatefulSet does not set automountServiceAccountToken: false; pods get unnecessary API credentials", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Set automountServiceAccountToken to false in the pod spec", "Only enable it for pods that genuinely need Kubernetes API access", "Use dedicated service accounts with minimal RBAC for pods that need API access" ], "commands": [ "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-RBAC-0002" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Set automountServiceAccountToken to false in the pod spec", "command": "kubectl get statefulset -n -o jsonpath='{.spec.template.spec.automountServiceAccountToken}'", "doc_ref": "cub-scan --explain CCVE-2025-3752" } }, { "id": "CCVE-2025-4075", "name": "ClusterRole grants nodes/proxy enabling Kubelet API RCE", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "critical", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "ClusterRole", "name": "pyroscope-alloy", "namespace": "default" }, "message": "ClusterRole grants nodes/proxy access, enabling full Kubelet API (exec/run/attach) on all nodes", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Audit all ClusterRoles for nodes/proxy permissions", "Remove nodes/proxy from ClusterRole rules unless strictly required", "Implement network policies restricting pod access to port 10250", "Deploy node-level runtime detection (Falco, Tetragon) for Kubelet connections", "Consider deploying Kyverno policy restrict-clusterrole-nodesproxy as admission guard", "Kyverno equivalents: KPOL-0279 and KPOL-0367", "Monitor KEP-2862 progress for fine-grained Kubelet authorization (K8s 1.36+)" ], "commands": [ "kubectl get clusterroles -o json | jq '.items[] | select(.rules[]?.resources[]? == \"nodes/proxy\") | .metadata.name'", "kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name == \"\") | {name: .metadata.name, subjects: .subjects}'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-RBAC-0001" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Audit all ClusterRoles for nodes/proxy permissions", "command": "kubectl get clusterroles -o json | jq '.items[] | select(.rules[]?.resources[]? == \"nodes/proxy\") | .metadata.name'", "doc_ref": "cub-scan --explain CCVE-2025-4075" } }, { "id": "CCVE-2025-4076", "name": "ClusterRoleBinding binds nodes/proxy ClusterRole to subjects", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "critical", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "ClusterRoleBinding", "name": "pyroscope-alloy", "namespace": "default" }, "message": "ClusterRoleBinding grants nodes/proxy via ClusterRole \"pyroscope-alloy\" to ServiceAccount default/pyroscope-alloy", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Identify which subjects are bound to the nodes/proxy ClusterRole", "Remove unnecessary bindings or switch to more restrictive ClusterRoles", "Audit ServiceAccount usage to verify necessity", "Restrict binding scope where possible", "Related policy controls: KPOL-0279 and KPOL-0367" ], "commands": [ "kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name == \"\") | {name: .metadata.name, subjects: .subjects}'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-RBAC-0001" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Identify which subjects are bound to the nodes/proxy ClusterRole", "command": "kubectl get clusterrolebindings -o json | jq '.items[] | select(.roleRef.name == \"\") | {name: .metadata.name, subjects: .subjects}'", "doc_ref": "cub-scan --explain CCVE-2025-4076" } }, { "id": "CCVE-2025-4078", "name": "ClusterRole grants secrets read permissions", "category": "SECURITY", "track": "misconfiguration", "detection_method": "native_rule", "severity": "critical", "confidence": "high", "tool": "kubernetes", "resource": { "kind": "ClusterRole", "name": "pyroscope-alloy", "namespace": "default" }, "message": "ClusterRole grants secrets get/list, enabling credential exfiltration across namespaces", "remedy_type": "config_fix", "remedy_safety": "safe_auto", "remediation": { "steps": [ "Remove secrets get/list permissions from ClusterRoles that do not require credential access", "Scope secret access to namespaced Role bindings where possible" ], "commands": [ "kubectl get clusterroles -o json | jq '.items[] | select(any(.rules[]?; any(.resources[]?; .==\"secrets\"))) | .metadata.name'" ] }, "evidence_source": "native", "control_ids": [ "CTRL-RBAC-0001" ], "action_type": "mutating", "next_step": { "action": "apply_fix", "description": "Remove secrets get/list permissions from ClusterRoles that do not require credential access", "command": "kubectl get clusterroles -o json | jq '.items[] | select(any(.rules[]?; any(.resources[]?; .==\"secrets\"))) | .metadata.name'", "doc_ref": "cub-scan --explain CCVE-2025-4078" } } ], "provenance": { "source": "cub-scan", "source_version": "v0.7.3", "scan_time": "2026-08-24T16:00:33Z", "catalog_version": "risk-catalog-v1.json@7ff79a126ad9" }, "pattern_bundle": { "schema_version": "bundle-manifest-v1", "version": "v0.7.3", "source_repo": "confighubai/confighub-scan", "manifest_sha256": "0405f6ffe21e567adf5d6a732d181c7f228194920456d046b4338baeb14de1a8", "catalog_sha256": "7ff79a126ad99bba2505fec8b2b7711c03f50eb362141128ec1c83e27a5036ba" }, "input": { "object_count": 17, "object_set_sha256": "sha256:64b360ba03fb15e2f4f5f13424c486ed4e0e15ad3a2aad18f7392d1a2daff94c" } } }