Incorrect Permission Assignment for Critical Resource
The product specifies permissions for a security-critical resource in a way that allows that resource to be read or modified by unintended actors.
When a resource is given permissions that are more open than necessary, unintended actors can access or modify that resource. This is especially critical for configuration files, executables, and data files.
How to fix this vulnerability
Disable automatic service account token mounting when API access is not needed
apiVersion: v1 kind: Pod spec: + automountServiceAccountToken: false containers: - name: app image: nginx:1.25
Enable read-only root filesystem and use emptyDir volumes for writable paths
apiVersion: v1 kind: Pod spec: containers: - name: app image: nginx:1.25 - ports: - - containerPort: 80 + securityContext: + readOnlyRootFilesystem: true + volumeMounts: + - name: tmp + mountPath: /tmp + volumes: + - name: tmp + emptyDir: {}
Find vulnerabilities in your code
Use Shoulder to scan your codebase for Incorrect Permission Assignment for Critical Resource patterns. 2 rules.
# Scan with Shoulder CLI npx @shoulderdev/cli trust --cwe=732 # Or scan entire project npx @shoulderdev/cli trust .
What to watch for in code reviews
These patterns indicate potential Incorrect Permission Assignment for Critical Resource vulnerabilities. Look for these during code reviews and security audits.
Scan your codebase for Incorrect Permission Assignment for Critical Resource
Shoulder CLI finds vulnerable patterns across your entire codebase.