CVE-2026-14450: Critical Kubernetes MaaS API Auth Bypass — Detection and Remediation Guide

---
title: Kubernetes ServiceAccount Token Minted via TokenRequest API
description: Detects creation of ServiceAccount tokens through the Kubernetes TokenRequest API, a capability abused in CVE-2026-14450 to mint SA tokens in other tenants' namespaces via the MaaS API auth bypass. Correlate source user/namespace against expected service identities.
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    objectRef.resource: 'serviceaccounts'
    objectRef.subresource: 'token'
    verb: 'create'
  filter_known_automation:
    user.username|startswith:
      - 'system:serviceaccount:kube-system:'
      - 'system:serviceaccount:monitoring:'
  condition: selection and not filter_known_automation
falsepositives:
  - Legitimate CI/CD or GitOps tooling requesting short-lived tokens for deployments
  - Cluster operators using kubectl create token during break-glass operations
level: high
tags:
  - attack.credential_access
  - attack.t1528
id: 4b1f6a2e-7c3d-4e5f-9a01-2c8d7e6f5a4b
status: experimental
author: Security Arsenal
date: 2026/06/09
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14450
---
title: Direct Pod-to-MaaS API Access Bypassing Ingress Gateway
description: Detects HTTP requests to the MaaS API service originating directly from pod IP ranges rather than the Kuadrant/Authorino gateway ingress identity, indicating CVE-2026-14450 exploitation where attackers forge X-MaaS-Username and X-MaaS-Group headers from inside the cluster.
logsource:
  product: kubernetes
  service: audit
detection:
  selection:
    requestURI|contains:
      - '/maas/'
      - '/v1/models'
      - '/v1/apikeys'
      - '/v1/tokens'
  filter_ingress:
    sourceIPs|contains:
      - '10.0.0.'
  condition: selection and not filter_ingress
falsepositives:
  - Internal health checks and monitoring scraping the MaaS API
  - Legitimate in-cluster service consumers (tune filter_ingress to your actual ingress gateway IPs)
level: high
tags:
  - attack.privilege_escalation
  - attack.t1078
id: 9e2c4d71-6b8a-4f3e-b5c2-1d7a9e0f3b6c
status: experimental
author: Security Arsenal
date: 2026/06/09
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14450
---
title: Forged MaaS Identity Headers in Application Logs
description: Detects presence of X-MaaS-Username or X-MaaS-Group headers in requests logged at the MaaS API where the request did not traverse the trusted authenticating proxy, or where the claimed identity belongs to privileged groups such as system:masters or cluster administrators — consistent with CVE-2026-14450 header forgery.
logsource:
  category: webserver
detection:
  selection_headers:
    http_headers|contains:
      - 'X-MaaS-Username'
      - 'X-MaaS-Group'
  selection_privileged:
    http_headers|contains:
      - 'system:masters'
      - 'cluster-admin'
      - 'platform-admin'
      - 'admin'
  condition: selection_headers and selection_privileged
falsepositives:
  - Legitimate administrative automation passing through the gateway (verify request source IP belongs to ingress)
level: critical
tags:
  - attack.defense_evasion
  - attack.t1550
id: 7f3a8b12-5d9c-4e6a-a1f4-8b2c6d0e9f7a
status: experimental
author: Security Arsenal
date: 2026/06/09
references:
  - https://nvd.nist.gov/vuln/detail/CVE-2026-14450

// Hunt for ServiceAccount token creation outside expected namespaces/service accounts
// Ingest Kubernetes audit logs into Sentinel via the kubeaudit/CEF pipeline.
CommonSecurityLog
| where TimeGenerated > ago(24h)
| extend Request = tostring(parse_json(AdditionalExtensions).requestURI)
| extend Verb = tostring(parse_json(AdditionalExtensions).verb)
| extend ObjResource = tostring(parse_json(AdditionalExtensions).resource)
| extend ObjSubresource = tostring(parse_json(AdditionalExtensions).subresource)
| extend ObjNamespace = tostring(parse_json(AdditionalExtensions).namespace)
| extend K8sUser = tostring(parse_json(AdditionalExtensions).username)
| where ObjResource == "serviceaccounts" and ObjSubresource == "token" and Verb == "create"
| extend Suspicious = iff(ObjNamespace !in ("kube-system", "monitoring") or K8sUser !startswith "system:serviceaccount:", true, false)
| where Suspicious
| summarize TokenRequests = count(), Namespaces = make_set(ObjNamespace), Users = make_set(K8sUser) by SourceIP, bin(TimeGenerated, 1h)
| order by TimeGenerated desc

-- Hunt pod network connections targeting the MaaS API service directly,
-- bypassing the Kuadrant ingress gateway (CVE-2026-14450 exploitation).
-- Adjust the MaaS API ClusterIP/port to your deployment.
SELECT Pid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ 'maas-api|X-MaaS-Username|X-MaaS-Group'
   OR Name =~ 'curl|wget|httpie|python'

-- Enumerate established connections to the MaaS API service port from pod processes
SELECT Pid, Name, RemoteAddress, RemotePort, Status
FROM netstat()
WHERE RemotePort in (8080, 8443)
  AND Status =~ 'ESTABLISHED'
  AND RemoteAddress =~ '10\\.\\d+\\.\\d+\\.\\d+|^fd|^fe80'

#!/usr/bin/env bash
# CVE-2026-14450 — MaaS API / Kuadrant AuthPolicy bypass hardening & verification script
# Run from a host with cluster-admin kubeconfig. Review before executing in production.

set -euo pipefail

echo "=== [1] Locate MaaS API deployments and Kuadrant/Authorino resources ==="
kubectl get deployments -A -o wide | grep -i maas || echo "No MaaS deployments found by name"
kubectl get authpolicies -A 2>/dev/null || echo "No AuthPolicy CRDs found"
kubectl get authorinos -A 2>/dev/null || true

echo "=== [2] Identify the MaaS API Service and its ClusterIP ==="
MAAS_SVC=$(kubectl get svc -A -o json | jq -r '.items[] | select(.metadata.name | test("maas";"i")) | "\(.metadata.namespace)/\(.metadata.name)"')
echo "MaaS services found: ${MAAS_SVC:-none}"

echo "=== [3] EMERGENCY WORKAROUND: NetworkPolicy restricting MaaS API ingress to the gateway only ==="
# Apply per MaaS namespace. Replace INGRESS_NS/labels with your actual gateway pod labels.
for entry in ${MAAS_SVC}; do
  NS="${entry%%/*}"
  cat <<EOF | kubectl apply -f -
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: maas-api-ingress-gateway-only
  namespace: ${NS}
spec:
  podSelector:
    matchLabels:
      app: maas-api
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kuadrant-system
      ports:
        - port: 8080
EOF
  echo "NetworkPolicy applied in namespace ${NS}"
done

echo "=== [4] Detect exploitation: TokenRequest events for serviceaccounts in audit logs ==="
# Requires Kubernetes audit logging enabled and accessible (adjust log path for your platform)
kubectl get events -A --field-selector reason=Created 2>/dev/null | grep -i token || true

echo "=== [5] Audit recently bound/created tokens via TokenReview-capable identities ==="
kubectl get clusterrolebindings -o json | jq -r '.items[] | select(.roleRef.name=="cluster-admin" or .roleRef.name | test("admin")) | .metadata.name' | while read -r crb; do
  echo "Privileged binding: ${crb}"
  kubectl get clusterrolebinding "${crb}" -o jsonpath='{.subjects}' ; echo
done

echo "=== [6] Verify MaaS API no longer accepts direct header-injected requests ==="
# From a test pod (NOT via ingress), this MUST return 401/403 after NetworkPolicy + patched MaaS API:
# kubectl run header-test --rm -i --restart=Never --image=curlimages/curl -- \
#   curl -s -o /dev/null -w '%{http_code}' -H 'X-MaaS-Username: admin' -H 'X-MaaS-Group: system:masters' \
#   http://<maas-api-svc>.<ns>.svc.cluster.local:8080/v1/models

echo "=== [7] Rotate all MaaS API keys and tenant ServiceAccount tokens (assume compromise) ==="
echo "Manually revoke and re-issue: kubectl delete secret <sa-token-secrets> -n <tenant-ns> to force re-minting"

echo "Done. Patch to the fixed MaaS API / Kuadrant release per the vendor advisory, then remove workarounds."