# Namespace or workload network restriction is ineffective

A disallowed fixture workload reaches a service across a network boundary that the deployment claims to enforce.

**Candidate CWE:** [CWE-923](https://cwe.mitre.org/data/definitions/923.html)

## Test hypothesis

Create one inert marker endpoint and two owned source pods. Compare one request from the allowed source and one from the denied source with the same destination and port; record labels, policy direction and CNI.

## Evidence required

Successful allowed control, disallowed-source marker response, source/destination identity and applicable policies plus enforcing implementation. CWE-923 is a candidate when the failed boundary permits communication with an unintended endpoint. Refine to the actual selector, permission-assignment, or enforcement mistake when supported; do not infer a particular implementation error from connectivity alone.

## Rule out false positives

A timeout while the service is broken, intentionally allowed egress, unsupported policy semantics, or a lab missing the production network plugin.

## Playbook and command references

- [Container and Kubernetes isolation](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/container-kubernetes.html) — Test RBAC, workload identity, admission, networking and host exposure as separate enforcement layers.
- [Database, cache, queue and management service boundaries](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/modules/network-service-boundaries.html) — Move from a reachable socket to a minimal proof of unintended service authority using synthetic records and paired identities.

[Find the associated command snippets](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/commands.html?q=Container%20and%20Kubernetes%20isolation)

## Referenced by these target playbooks

[Cloud & containers](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/cloud.html) · [Network services](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/network.html)

## Report checklist

- [ ] Capture the affected version, configuration, identities, and object ownership.
- [ ] Preserve a valid baseline and a negative control.
- [ ] Reproduce the forbidden data access, action, or state change on controlled fixtures.
- [ ] Explain the intended security rule and why the observed behavior violates it.
- [ ] State prerequisites, uncertainty, cleanup, and the smallest demonstrated impact.

## Conditional ATT&CK mapping

No direct ATT&CK mapping selected. Record the weakness and demonstrated impact without forcing an adversary-behavior classification. See the [mapping guide](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/attack.html).

## Primary references

- [Kubernetes NetworkPolicy semantics](https://kubernetes.io/docs/concepts/services-networking/network-policies/)
- [MITRE CWE-923](https://cwe.mitre.org/data/definitions/923.html)
- [MITRE CWE-284](https://cwe.mitre.org/data/definitions/284.html)

[Back to the complete vulnerability catalog](https://bug-bounty-field-manual.kmahshooq.chatgpt.site/vulnerabilities.html)