# cyberark/KubiScan

A tool to scan Kubernetes cluster for risky permissions

Repository: https://github.com/cyberark/KubiScan
Canonical: https://ross.abutalabs.com/products/kubiscan
Language: Python
License: GPL-3.0
License Family: copyleft
Topics: kubernetes, rbac, authorization, conjbot
Last push: 2025-05-25T11:33:02+00:00

## Health v2 (maintenance only)
Score: 33/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 23, release rhythm 8, longevity 100
- inputs: {"age_days": 2865, "days_push": 465, "days_rel": null, "gap_med": null, "n_releases_24m": 0}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 1431, forks 142 (observed 2026-08-28T04:04:42.342263+00:00)

## What it is
KubiScan is a Python CLI tool that scans Kubernetes clusters for risky permissions in the RBAC authorization model. It identifies risky roles, bindings, subjects, and pods, and can dump tokens to help administrators reduce cluster attack surface.

## Use cases
- scan kubernetes cluster for risky rbac permissions
- find over-privileged service accounts in k8s
- audit rolebindings and clusterrolebindings for excessive access
- dump service account tokens from pods
- identify pods with access to secrets
- check which users can escalate privileges in a cluster

## When to choose
- you need to audit RBAC risk across a large Kubernetes cluster
- you want automated detection of privilege escalation paths in k8s
- you run EKS, AKS, or GKE and need RBAC visibility

## When to avoid
- you need continuous runtime security monitoring rather than point-in-time scanning
- your cluster does not use RBAC authorization
- you need a GUI-based policy management tool

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, authorization, vulnerability-scanning
- domain: security
- platform: cli, python, cross-platform
- tags: kubernetes-rbac, cluster-security, penetration-testing, service-accounts, risk-audit, containers, devops, kubernetes, docker

## Member repositories
- cyberark/KubiScan (main) score 33

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:04:42.342263+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-30T04:37:06.641451+00:00, confidence not recorded.
  - readme: https://github.com/cyberark/KubiScan (fetched 2026-08-28T04:04:42.342263+00:00, sha fdaa31ea4db2)
- Data as of 2026-08-30T08:39:29.467469+00:00.