Service Account Token Auto-Mounted

Description

Detects pods with service account token auto-mounting enabled.

What Shoulder detects

Service account token is automatically mounted into the pod.

How to fix

Disable auto-mounting if not needed.

```yaml
spec:
  automountServiceAccountToken: false
```

Learn more: https://shoulder.dev/learn/kubernetes/cwe-732/automount-service-account

Applies to

Languages

📄 YAML

Frameworks

kubernetes

References

Documentation ↗ Learn about CWE-732

Scan for this issue

Detect with Shoulder CLI

npx @shoulderdev/cli trust --rule=kubernetes-automount-service-account .