The API server in Kubernetes might allow remote attackers to gain privileges by editing a build configuration to use a restricted strategy.