Wiz releases open-source NamespaceHound for Kubernetes security

Wiz has released NamespaceHound, an open-source tool that detects potential namespace crossing violations and anonymous access opportunities in multi-tenant Kubernetes clusters. The tool aims to help security teams identify risks in shared cluster environments.

NamespaceHound runs an analysis of a cluster to determine all possible ways to cross security boundaries between namespaces, and can focus on a specific namespace if given via the -n parameter. It also inspects the cluster configuration for anonymous access opportunities. The tool is useful for red-teamers and security researchers to find lateral movement paths after initial access.

NamespaceHound requires read permissions on all resource types and does not save any data about the target cluster locally. It establishes a new connection with the cluster upon every run and performs API server queries in the same capacity. The tool can detect a wide scope of namespace crossings, with 22 types listed in the GitHub repository.