Container Misconfiguration
High · Configuration
OWASP Top 10:2025 (current)
Not directly mapped to a Top 10:2025 category — see CWE / CVE below.
CWE
CWE-16
CVE / class examples
- Search NVD/CVE for product-specific instances of this CWE
All refs
CWE-16
Definition
Privileged containers, root user, exposed sockets.
Root cause
Insecure Dockerfile/K8s spec.
Affected components
- Components in the “Configuration” class
- Application / API handlers
- Supporting libraries
Impact
Container escape, cluster compromise.
Severity
High · CVSS 8.8
Safe lab reproduction
lab-docker
Detection methodology
CIS benchmarks; kube-bench.
Evidence examples
- Lab reproduction notes: lab-docker
- Request/response excerpts (redacted)
- Detection signal: CIS benchmarks; kube-bench
Remediation
Non-root, drop caps, read-only root FS.
Secure coding examples
Scan images and manifests in CI.
Related CYNARKS lessons & labs
Tools: trivy · kube-bench
Practise related skills in Labs or deepen on Academy library.