Researchers Chain Cloud Infrastructure Flaws to Bypass Tenant Isolation
Summary
A bug bounty assessment of an unnamed cloud provider chained Kubernetes, control-plane and managed-service flaws to bypass tenant isolation. The researchers say the provider fixed all reported issues.
Key points
- A privileged Kubernetes pod gave researchers root access to a worker node and its Konnectivity service token.
- Researchers used Konnectivity packet handling to reach control-plane sockets and execute code, then exploited an OverlayFS flaw to gain root privileges.
- A flat overlay network exposed managed services; shared logs contained root SSH keys that could be matched to other tenants’ cluster nodes.
- An exposed Kafka JMX service, Redis exporter credential leakage and unrestricted PostgreSQL configuration storage provided additional cross-tenant attack paths.
- SQL injection in a custom Salt extension exposed Salt master authentication tokens, potentially allowing commands across cloud minions; researchers did not develop that attack further by agreement with the vendor.
- Researchers also examined CVE-2026-25243 in Valkey and a MySQL configuration-injection chain as alternative routes into the infrastructure.
- The provider was advised to isolate managed services, enforce AppArmor policies and monitor potentially vulnerable services. Researchers say all reported issues were fixed.
Article Details
- Attack Vectors
- A privileged Kubernetes pod with host namespace access let researchers escape to a worker node and obtain a Konnectivity service token.
- A crafted Konnectivity DIAL_REQ enabled server-side requests from the control plane, including access to D-Bus sockets and execution of a transient user service.
- An OverlayFS capability-handling flaw enabled root escalation on the control-plane host.
- A flat overlay network exposed shared metrics, logs and managed services. Logs contained root SSH private keys for other tenants’ nodes.
- An exposed Kafka JMX registry allowed a custom MBean to be loaded and used for remote command execution.
- The redis-exporter scrape endpoint could be directed to a researcher-controlled host, exposing credentials used to access other customers’ Redis instances.
- Unauthenticated etcd access allowed modification of Patroni configuration to execute a command on a PostgreSQL host.
- SQL injection through Salt minion grains exposed database records containing Salt master authentication tokens.
- CVE-2026-25243 in managed Valkey was used to obtain host access; the researchers then used a local privilege escalation vulnerability.
- MySQL privilege-table manipulation and configuration injection enabled execution of a custom UDF, followed by root escalation through a privileged watcher service.
- Defensive Notes
- The provider fixed all security issues reported by the researchers.
- The researchers recommended isolating managed services to prevent network visibility between them, enforcing strict AppArmor policies and monitoring the use of potentially vulnerable services.
MITRE ATT&CK
T1021.004 · SSHRoot SSH private keys found in shared logs could be used to access other tenants’ nodes.T1046 · Network Service DiscoveryResearchers scanned control-plane and managed-service hosts to identify exposed ports, including JMX, etcd and Patroni services.T1059.004 · Unix ShellThe control-plane transient service and custom Kafka MBean executed commands through Unix shells.T1068 · Exploitation for Privilege EscalationResearchers exploited an OverlayFS capability-handling flaw to obtain root privileges on the control-plane host.T1098.004 · SSH Authorized KeysAfter exploiting managed Valkey, researchers added an SSH key to the Valkey account’s authorized_keys file for independent host access.T1105 · Ingress Tool TransferThe Kafka test loaded a researcher-created MBean JAR from a remote web server for command execution.T1552.001 · Credentials In FilesShared logs exposed root SSH private keys generated by cloud-init, and files on PostgreSQL hosts contained S3 credentials.T1611 · Escape to HostResearchers used a privileged pod and nsenter to escape the container and obtain root access to the Kubernetes worker node.
CVE
Vendors
Products
Apache KafkaWe explored the option to deploy managed Apache Kafka resources.k0sFirst, we created a resource in the cloud’s managed Kubernetes cluster (v1.25.16+k0s.0).KonnectivityWhile researching the data plane, we found a Konnectivity service token.Kubernetes1. Gaining initial access through a managed Kubernetes clusterMySQLThe MySQL database user didn’t have root privileges when the resource was created.PatroniCompromise of managed PostgreSQL (Patroni) clustersPostgreSQLCompromise of managed PostgreSQL (Patroni) clustersRedisCredential leakage through redis-exporterredis-exporterCredential leakage through redis-exporterSaltStackThis significantly expands the attack surface by providing access to the managed cloud’s own control plane through SaltStack.ValkeyDiagnostic information of the Valkey instanceVictoriaLogsWe found another host from the Victoria ecosystem on the same network: VictoriaLogs.VictoriaMetricsThe IP address turned out to belong to a metrics collector, one of the VictoriaMetrics instances serving numerous managed resources.