Cloud Provider Vulnerability Chain Allows Tenant to Bypass Isolation and Gain Root Access
Researchers uncovered a critical vulnerability chain in a major cloud provider's infrastructure, enabling a tenant to escape container isolation and achieve root access to worker nodes, with potential for broader compromise.
A recent penetration test of a major cloud provider's infrastructure has revealed a critical vulnerability chain that allowed a tenant to bypass isolation mechanisms and gain root access to worker nodes. This discovery challenges the common perception that cloud data breaches are solely the fault of customer misconfigurations, highlighting significant risks originating from the provider's own systems.
The attack began with a tenant creating a privileged pod within a managed Kubernetes cluster. While cloud providers typically restrict direct SSH access to worker nodes, the cluster's security policies in this instance permitted the creation of privileged pods with access to host namespaces. This allowed the researchers to use the nsenter command within the pod to switch the execution context to the actual host machine, effectively gaining full root access to the worker node.
Upon gaining root access to the worker node, the researchers analyzed its file system and network interfaces. They discovered a Konnectivity service token, a component responsible for establishing a secure tunnel between the Kubernetes control plane and the data plane. This token granted them permission to interact with the Konnectivity service, which was running on port 8132.
Further investigation into the Konnectivity service, identified as a fork of apiserver-network-proxy used in k0s, a minimalist Kubernetes distribution, revealed its function: to enable communication between the control plane and worker nodes, even when nodes are behind a NAT. The service's AgentService exposes a Connect method that accepts a stream of Packet objects. Crucially, when the agent (worker node) sends a DIAL_REQ packet, the server initiates a net.Dial() function call on the control plane side.
This mechanism presented a significant vulnerability. By manipulating the Packet structure, specifically the DialRequest payload, the researchers could trick the Konnectivity server into establishing arbitrary network connections from the control plane. This effectively allowed them to pivot from the compromised worker node to other services within the cloud provider's internal network.
The implications of this vulnerability chain are severe. Gaining root access to worker nodes and subsequently interacting with control plane services like Konnectivity could lead to a complete bypass of tenant isolation. This could grant an attacker access to sensitive management components, other tenants' resources, or even the core infrastructure of the cloud provider.
The research was conducted as part of an official bug bounty program, and the cloud provider has since fixed all identified vulnerabilities in line with responsible disclosure policies. The analysis, anonymized to protect the provider's identity, was presented at the Security Analyst Summit (SAS 2026) and highlights the importance of continuous security testing and collaboration between providers and independent researchers.
This case underscores the critical need for cloud providers to rigorously audit their own infrastructure for vulnerabilities, not just rely on customer-side security. The ability for a tenant to escape isolation and compromise the underlying infrastructure poses a fundamental threat to the trust and security expected from cloud services.