Skip to main content
Daily Risk Register

Enterprise Config Traps

A searchable catalogue of dangerous defaults, brittle infrastructure patterns, and production-grade configuration failures that hide in ordinary enterprise platforms.

/

Active Threat Records

157 RECORDS
Kuberneteshigh

A Wildcard Verb in a ClusterRole Quietly Grants Cluster-Wide Write Access

A ClusterRole edited for a debugging session and left with verbs: ["*"] silently grants cluster-wide write and delete access, because RBAC applies wildcards literally regardless of the role's original intent.

Inspect Trap and Fix
Active Directoryhigh

AdminSDHolder Protection Silently Skips Groups Nested Below Domain Admins

A group nested two levels below Domain Admins in Active Directory can lose its inherited privileged ACL silently, because AdminSDHolder's SDProp protection does not reliably extend to that nesting depth.

Inspect Trap and Fix
DNSmedium

DNS Resilience Defaults Silently Override Expected Safeguards

A resolver's negative-caching TTL can silently outlast an intended DNS failover window, making a resilience design look broken when the real fault is a caching default nobody reviewed.

Inspect Trap and Fix
Microsoft Azurehigh

Azure Storage 'Selected Networks' Firewall Still Allows Trusted Azure Services Through

An Azure Storage account locked to 'Selected networks' still allows any trusted Azure service to bypass the firewall by default, letting unapproved resources read and write data through an exception hidden below the subnet rule list.

Inspect Trap and Fix
Amazon Web Serviceshigh

A Security Group Referencing Itself Silently Opens Every Port Inside a VPC

A self-referencing security group rule looked like a safe intra-tier allowance, but an unscoped port range from an old troubleshooting session let every instance in the group reach every other instance on every port.

Inspect Trap and Fix
Amazon Web Serviceshigh

AWS IAM Policy Design Defaults Silently Override Expected Safeguards

An AWS IAM policy relying on implicit defaults for resource scoping fails to restrict access when new services are added, leading to unintended privilege escalation.

Inspect Trap and Fix
DNShigh

A Wide-Open DNS Forwarder ACL Lets Any Client Recurse Through Your Resolver

A DNS resolver left with an open or unscoped recursion ACL answers internal clients normally while silently permitting recursive queries from any network that can reach it, exposing the organisation to amplification abuse and cache poisoning risk.

Inspect Trap and Fix
Active Directoryhigh

Allowing Nonsecure Dynamic Updates Lets Any Host Hijack an AD-Integrated DNS Zone

An AD-integrated DNS zone left on Nonsecure and secure dynamic updates accepts unauthenticated record writes from any reachable host, letting rogue devices silently hijack names used by domain controllers and services.

Inspect Trap and Fix
Microsoft Azuremedium

System-Assigned Managed Identity Silently Loses Access After a VM Rebuild

Recreating an Azure VM with the same name generates a brand-new system-assigned managed identity object ID, silently orphaning existing RBAC role assignments and breaking application authentication without any visible configuration change.

Inspect Trap and Fix
Active Directoryhigh

Nested Membership in Domain Admins Escapes AdminSDHolder Protection

Nesting a group inside Domain Admins grants Domain Admin-equivalent rights to its members, but AdminSDHolder only protects direct membership, leaving the nested group and its members unflagged, unaudited and easy to miss.

Inspect Trap and Fix
Kuberneteshigh

Namespace-Wide RBAC Read on Secrets Lets Any Pod Read Every Team's Credentials

A Role granting get/list/watch on secrets without resourceNames lets any pod's ServiceAccount read every Secret in the namespace, not just its own, when combined with default token automounting.

Inspect Trap and Fix
Kuberneteshigh

kubelet Anonymous Auth Left On Grants Unauthenticated Root-Level Node API Access

A node's kubelet API can silently bypass cluster RBAC entirely when anonymous authentication is left enabled, letting unauthenticated network clients read pod data and execute commands.

Inspect Trap and Fix