Raqib v0.11.0

Raqib v0.11.0

Deepens lateral movement coverage on Azure, GCP, and Kubernetes, and fixes a bug in the Azure model. Both the bash scanner and the Python engine gain the checks and stay in lockstep, as the parity test asserts.

GCP lateral movement

• A default service account with a broad role. The Compute Engine, App Engine, and Google APIs default service accounts are attached to compute by default, so Editor or Owner on one is a pivot: a foothold on a VM or a function inherits that reach.
• A group holding Owner or Editor. The membership is managed outside the project, so who actually holds the access is not visible in the IAM policy.

Kubernetes lateral movement

• Reaching the kubelet on nodes through nodes/proxy, which runs commands in the pods on a node and reads their logs and mounted tokens.
• Port forwarding to pods, a tunnel to a pod and any service reachable from it.

Azure lateral movement

• An identity that spans multiple subscriptions, a single compromised principal that reaches across them.

Fix

• The bash Azure model kept only the last role assignment for a principal that held several, because it merged assignments with the wrong operator. It now accumulates every assignment, matching the Python engine. This was latent until a principal held roles in two subscriptions; the parity test now covers it.

Quality

• New sample principals for each path and six new tests. All four least privilege samples still produce zero findings, and the two engines produce the same findings on every cloud. 133 tests pass.

Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.