The nodes/proxy GET RBAC permission allows any ServiceAccount to execute code inside any Pod in the cluster, without leaving a single trace in the audit logs. This article details the issue, how to check if you are vulnerable, the fixes to apply, and the preventive measures you can put in place if you can't patch right away.
https://blog.zwindler.fr/en/2026/05/19/nodes/proxy-get-one-kubernetes-permission-too-many