Cloud Isolation Failures Expose Path From Tenant Kubernetes Access to Infrastructure Takeover

An authorized bug bounty assessment of an unnamed cloud provider uncovered a vulnerability chain that allowed a regular tenant to bypass isolation boundaries and potentially take over cloud infrastructure. Researchers progressed from a privileged Kubernetes pod to root access on a worker node, exploited Konnectivity to execute code on the control plane, and escalated privileges through an OverlayFS vulnerability. A flat shared network also exposed other tenants’ managed services, including monitoring systems that leaked root SSH keys, vulnerable database management interfaces, and Redis exporters that disclosed credentials.

SQL injection in a custom SaltStack extension exposed Salt master authentication tokens, creating a path to command execution across cloud resources. Researchers also demonstrated alternative exploitation chains involving Valkey and MySQL, highlighting multiple routes into the shared infrastructure. They stopped further exploitation by agreement with the provider and responsibly disclosed the findings; all identified issues were reported fixed. The findings underscore the importance of enforcing tenant network isolation, restricting privileged workloads and management-plane access, and preventing credentials from leaking through monitoring services.