Critical Vulnerability Chain Bypasses Tenant Isolation in Managed Cloud Platform
What Happened — Researchers from Kaspersky’s bug‑bounty program discovered a sequence of flaws in a major cloud provider’s managed services that together allowed a regular tenant to break out of its sandbox and gain control of the provider’s control‑plane. The chain began with a privileged pod creation in a managed Kubernetes cluster (v1.25.16+k0s.0) that escaped the worker node because the provider’s policies allowed host‑namespace access. From there the attackers pivoted through the Konnectivity proxy, escalated privileges on the host, compromised overlay‑network components (Victoria stack, managed Kafka, Redis‑exporter, Patroni PostgreSQL), and finally abused a SQL injection in the provider’s SaltStack management interface. All issues were responsibly disclosed and patched before any public exploitation.
Why It Matters for Trust & Control Assurance — The incident tests the control objective of tenant isolation and segmentation; proving that isolation controls are enforced and continuously verified is essential for audit readiness.
Who Is Affected — Cloud‑infrastructure providers, SaaS platforms that rely on managed Kubernetes, and any organization that runs workloads in multi‑tenant cloud environments.
Recommended Actions
- Review and harden pod security policies to block privileged pod creation and host‑namespace access.
- Validate that isolation‑enforcing components (e.g., Konnectivity, overlay networks) are correctly configured and monitored.
- Incorporate regular penetration testing and bug‑bounty feedback into your continuous assurance program.
- Map isolation controls to your framework of record and collect defensible evidence of compliance.
Technical Notes
- Vulnerable component: Managed Kubernetes (v1.25.16+k0s.0) – privileged pod escape.
- Additional flaws: Mis‑configured Konnectivity proxy, insecure Victoria stack, exposed Redis‑exporter credentials, insecure SaltStack UI (SQLi).
- No CVE identifiers were assigned at the time of disclosure; all issues have been patched by the provider.