The incluster-checks Python CLI tool spawns privileged debug pods on every node of an OpenShift cluster using `oc debug node/<name>`. These pods run with hostPID, hostNetwork, privileged securityContext, and the host root filesystem mounted at /host, then execute `bash -c "chroot /host <cmd>"` inside them.

The pods are created in the `default` namespace by default. The `default` namespace on OpenShift is shared and broadly accessible — any user with the standard `edit` ClusterRole (the most common developer-facing role) has `pods/exec` permission there. CIS Kubernetes Benchmark 5.7.4 explicitly warns against running workloads in the `default` namespace because RBAC is broadly scoped.

During a check run (or during the up-to-4-hour orphan window if cleanup is interrupted), any cluster user with `edit` access can `oc exec` into these privileged pods and obtain root access on every cluster node. No additional vulnerability or unusual access level is required.

```python
# src/in_cluster_checks/core/executor.py
class NodeExecutor:
    def __init__(self, node_name: str, namespace: str = "default", ...):
        self.namespace = namespace
```

The tool ships no Namespace, PodSecurity label, NetworkPolicy, or RBAC manifest to isolate these workloads.

Affected file: `src/in_cluster_checks/core/executor.py:99-213` in https://github.com/RedHatInsights/incluster-checks

Remediation: Ship a dedicated namespace manifest labelled with PodSecurity enforcement, add a default-deny NetworkPolicy, restrict pods/exec via RBAC to the invoking ServiceAccount, and refuse to run against the `default` namespace.