STIGQter: STIG Summary: Kubernetes Security Technical Implementation Guide Version: 2 Release: 6 Benchmark Date: 01 Apr 2026:

Kubernetes must limit Secret access on a need-to-know basis.

DISA Rule

SV-274884r1107245_rule

Vulnerability Number

V-274884

Group Title

SRG-APP-000429-CTR-001060

Rule Version

CNTR-K8-001163

Severity

CAT II

CCI(s)

• CCI-002476 - Implement cryptographic mechanisms to prevent unauthorized disclosure of organization-defined information at rest on organization-defined system components.

Weight

10

Fix Recommendation

For Kubernetes accounts that have read access to Secrets without a documented requirement, modify the corresponding Role or ClusterRole to remove list, watch, and get privileges for Secrets.

Check Contents

Review the Kubernetes accounts and their corresponding roles.

If any accounts have read (list, watch, get) access to Secrets without a documented organizational requirement, this is a finding.

Run the below command to list the workload resources for applications deployed to Kubernetes:
kubectl get all -A -o yaml

If Secrets are attached to applications without a documented requirement, this is a finding.

Vulnerability Number

V-274884

Documentable

False

Rule Version

CNTR-K8-001163

Severity Override Guidance

Review the Kubernetes accounts and their corresponding roles.

If any accounts have read (list, watch, get) access to Secrets without a documented organizational requirement, this is a finding.

Run the below command to list the workload resources for applications deployed to Kubernetes:
kubectl get all -A -o yaml

If Secrets are attached to applications without a documented requirement, this is a finding.

Check Content Reference

M

Target Key

5376