Tenant isolation bypass achieved via chained cloud provider vulnerabilities
The claim
The authors assert that a chain of misconfigurations and bugs in a major cloud provider allows an external tenant to fully break isolation and control other tenants' resources.
Published as: “An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure”
So what
Cloud providers must enforce strict isolation between managed services and audit internal APIs to prevent cross-tenant compromise.
The five-minute version
The researchers, posing as a regular tenant, created a privileged pod in a managed Kubernetes cluster and escaped to the host node. They leveraged a Konnectivity token to issue DIAL_REQ packets, achieving SSRF on the control plane and using D-Bus to start a user systemd service. Subsequent steps exploited OverlayFS, exposed cross-tenant metrics via VictoriaMetrics, and abused misconfigured services (Redis exporter, Kafka JMX, Patroni) to gain root on the control plane and access other tenants, demonstrating a complete isolation breach. The evidence is based on a live bug-bounty engagement on a real cloud platform.
What they found 3
- Privileged pod creation allowed escape from container to host node.
“After creating the privileged pod, we ran the nsenter command inside the container. It moved the execution context to the host machine:”
- Konnectivity DIAL_REQ handling caused an SSRF that could reach host UNIX sockets.
“conn, err := net.Dial(dialReq.Protocol, dialReq.Address) // we control proto and address”
- VictoriaMetrics API exposed labels that listed control-plane hosts of other tenants.
“"discoveredLabels": { "__address__": "http://100.64.1.1:6897/metrics", "__meta_url": "CENSORED", "__metrics_path__": "/metrics", "__scheme__": "http", "__scrape_interval__": "2m0s", "__scrape_timeout__": "2m0s", "cluster_id": "676767", "customer": "customerID", "job": "http", "profile": "kubernetes", "vds_id": "1337", "version": "1.0" }”
What undercuts it the paper’s own results
- All security issues we found were fixed in full.
- The attack was not developed further by agreement with the vendor.
Stated limits 2
- Other vulnerabilities were left out of the report because they were considered standard.
- The researchers stopped after obtaining Salt master tokens per agreement with the vendor.
What’s new here 4
- Demonstrates SSRF primitive in Kubernetes Konnectivity service allowing control-plane code execution.
- Shows cross-tenant data exposure via VictoriaMetrics and VictoriaLogs APIs.
- Exploits OverlayFS capability bug for privilege escalation on worker nodes.
- Chains multiple service misconfigurations (Redis exporter, Kafka JMX, Patroni) to achieve full tenant isolation bypass.
Artifacts & methods 10
- privileged pod with hostPIDprimitive
- nsenterprimitive
- Konnectivity tokenprimitive
- custom D-Bus client (godbus/dbus)system
- OverlayFS capability bug exploitprimitive
- VictoriaMetrics metrics endpointevaluation
- Kafka JMX RMI MLet exploitprimitive
- Redis exporter target parameter abuseprimitive
- Patroni etcd configuration manipulationprimitive
- SaltStack custom pillar script SQL injectionprimitive