An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure
Security researchers have identified a critical vulnerability chain in a major cloud provider's infrastructure that allowed complete bypass of tenant isolation, potentially granting attackers full control of the cloud environment.
The research, which won second place in the System Hacking category at Russian Pentest Award 2026, was conducted as part of an official bug bounty program. The vulnerabilities were responsibly disclosed to the cloud provider and have since been fully patched. The infrastructure analyzed was anonymized to protect the organization's identity.
Many experts believe cloud data breaches are primarily caused by customer misconfigurations, but this research demonstrates that critical threats can originate within the provider's own infrastructure. The attack chain began with escaping a worker node in a managed Kubernetes cluster (v1.25.16+k0s.0).
Escaping the Container
The researchers created a privileged pod in the Kubernetes cluster, which allowed them to switch execution context to the host machine. This was possible because the cluster's security policies didn't prevent the creation of privileged pods with access to host namespaces.
After gaining access to the host machine, they analyzed its file system and found a Konnectivity service token. This component provides a tunnel between the control plane and data plane of a Kubernetes cluster, creating a critical attack vector.
Exploiting Konnectivity
The researchers discovered that port 8132, which hosts the Konnectivity service, contained a Server-Side Request Forgery (SSRF) vulnerability. This allowed them to reach not only network resources but also host UNIX sockets, including D-Bus.
The server reads any Packet packets from the stream initiated by the agent (worker node)
By exploiting this vulnerability, they were able to create a user service on the control plane and execute arbitrary code. This gave them a callback from the control plane, marking a significant escalation in the attack chain.
Privilege Escalation
Since konnectivity-server runs with limited privileges by default, the researchers needed to escalate these privileges to gain full control. They identified a running salt-minion service on the control plane node, which with root privileges could be used for further authentication and attacks.
Mirantis, the company behind the k0s project, confirmed the vulnerability. The research underscores the importance of regular penetration testing, bug bounty programs, and collaboration between developers and independent researchers in maintaining cloud security.
Related
