# GKE Autopilot Node Compromise via local-storage PersistentVolume

GKE Autopilot allowed local-storage PersistentVolumes to mount node /run, exposing docker.sock and enabling root shell on managed nodes.

- Payout: $1,337
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2021-03-01
- Write-up quality: 7/10
- Original: https://lf.lc/vrp/181521559a/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559a
- Tags: domain:cloud impact:data-leak impact:internal-access impact:privesc kind:bounty platform:blog sev:high tech:docker tech:kubernetes technique:source-review vuln:misconfiguration vuln:privilege-escalation

**Target:** GKE Autopilot managed Kubernetes node
**Root cause:** Autopilot blocked privileged pods and hostPath mounts but not local-storage PersistentVolumes, which can mount arbitrary node paths like /run into a pod.
**Steps:**
1. Create an Autopilot cluster and authenticate via `gcloud container clusters get-credentials`
2. Create a dummy pod to trigger autoscaler node provisioning; record its node name
3. Deploy `docker.yaml` defining a local-storage PersistentVolume mounting `/run` from that node into an exploit pod
4. Delete the dummy pod so the exploit pod schedules on the same node
5. Exec into exploit pod and run `docker -H unix:///host/docker.sock run --rm -it --privileged --net=host --pid=host alpine nsenter --mount=/proc/1/ns/mnt -- /bin/bash` to get root on node
**How found:** Observed that Autopilot's hostPath and privileged-pod restrictions did not cover local-storage PersistentVolumes, which behave like hostPath mounts; tested mounting /run to reach docker.sock.
**Exploitation:** A user with pod and PV creation rights provisions a node, mounts its /run via local-storage PV, then uses the exposed docker.sock to launch a privileged container with host namespaces and nsenter into the node's root mount namespace, yielding root on the managed node.
**Escalation:** From node root, read all cluster secrets beyond provisioned access and retrieve the default compute service account token from the node metadata service.
**Insight:** When a platform blocks hostPath, enumerate other volume types (local-storage PVs, CSI drivers, projected volumes) that can still bind node paths; /run and docker.sock are high-value mount targets.