What happened
A Kaspersky security researcher, working under a bug‑bounty program, demonstrated how a regular tenant could break out of a managed Kubernetes cluster (v1.25.16+k0s.0) by creating a privileged pod that accessed the host namespace. The attacker then leveraged the Konnectivity proxy to reach the control plane, escalated privileges on the host, compromised overlay‑network services (Victoria stack, managed Kafka, Redis‑exporter, Patroni PostgreSQL), and finally exploited a SQL injection in the provider’s SaltStack management UI. All issues were responsibly disclosed and patched before any public exploitation.
Why it matters for trust and compliance
- The chain directly tests the isolation and segmentation control objective; proving that tenant boundaries are enforced and continuously monitored is a key trust signal for auditors.
- Map isolation controls to your framework of record and collect continuous evidence of enforcement.
- Use automated control‑mapping to surface misconfigurations before they become exploitable.
Who is affected
Cloud infrastructure providers Enterprises running workloads in multi‑tenant cloud environments
Recommended actions
- Audit pod security policies to block privileged pod creation and host‑namespace access.
- Validate configuration and monitoring of isolation‑enforcing components such as Konnectivity and overlay networks.
- Integrate regular pentesting and bug‑bounty findings into your continuous assurance workflow.