Enterprise Config Traps
A searchable catalogue of dangerous defaults, brittle infrastructure patterns, and production-grade configuration failures that hide in ordinary enterprise platforms.
Active Threat Records
157 RECORDSA Wildcard Verb in a ClusterRole Quietly Grants Cluster-Wide Write Access
A ClusterRole edited for a debugging session and left with verbs: ["*"] silently grants cluster-wide write and delete access, because RBAC applies wildcards literally regardless of the role's original intent.
AdminSDHolder Protection Silently Skips Groups Nested Below Domain Admins
A group nested two levels below Domain Admins in Active Directory can lose its inherited privileged ACL silently, because AdminSDHolder's SDProp protection does not reliably extend to that nesting depth.
DNS Resilience Defaults Silently Override Expected Safeguards
A resolver's negative-caching TTL can silently outlast an intended DNS failover window, making a resilience design look broken when the real fault is a caching default nobody reviewed.
Azure Storage 'Selected Networks' Firewall Still Allows Trusted Azure Services Through
An Azure Storage account locked to 'Selected networks' still allows any trusted Azure service to bypass the firewall by default, letting unapproved resources read and write data through an exception hidden below the subnet rule list.
A Security Group Referencing Itself Silently Opens Every Port Inside a VPC
A self-referencing security group rule looked like a safe intra-tier allowance, but an unscoped port range from an old troubleshooting session let every instance in the group reach every other instance on every port.
AWS IAM Policy Design Defaults Silently Override Expected Safeguards
An AWS IAM policy relying on implicit defaults for resource scoping fails to restrict access when new services are added, leading to unintended privilege escalation.
A Wide-Open DNS Forwarder ACL Lets Any Client Recurse Through Your Resolver
A DNS resolver left with an open or unscoped recursion ACL answers internal clients normally while silently permitting recursive queries from any network that can reach it, exposing the organisation to amplification abuse and cache poisoning risk.
Allowing Nonsecure Dynamic Updates Lets Any Host Hijack an AD-Integrated DNS Zone
An AD-integrated DNS zone left on Nonsecure and secure dynamic updates accepts unauthenticated record writes from any reachable host, letting rogue devices silently hijack names used by domain controllers and services.
System-Assigned Managed Identity Silently Loses Access After a VM Rebuild
Recreating an Azure VM with the same name generates a brand-new system-assigned managed identity object ID, silently orphaning existing RBAC role assignments and breaking application authentication without any visible configuration change.
Nested Membership in Domain Admins Escapes AdminSDHolder Protection
Nesting a group inside Domain Admins grants Domain Admin-equivalent rights to its members, but AdminSDHolder only protects direct membership, leaving the nested group and its members unflagged, unaudited and easy to miss.
Namespace-Wide RBAC Read on Secrets Lets Any Pod Read Every Team's Credentials
A Role granting get/list/watch on secrets without resourceNames lets any pod's ServiceAccount read every Secret in the namespace, not just its own, when combined with default token automounting.
kubelet Anonymous Auth Left On Grants Unauthenticated Root-Level Node API Access
A node's kubelet API can silently bypass cluster RBAC entirely when anonymous authentication is left enabled, letting unauthenticated network clients read pod data and execute commands.