# GKE Autopilot Node Compromise via SSH Metadata

GKE Autopilot nodes trust project-wide SSH metadata keys; SSH tunneling bypasses nologin shells to reach node metadata and steal kubelet TPM creds, escalating to cluster-admin.

- Payout: $1,337
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2021-03-05
- Write-up quality: 8/10
- Original: https://lf.lc/vrp/181521559c/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559c
- Tags: domain:cloud impact:data-leak impact:privesc kind:bounty platform:blog sev:high tech:gcp tech:kubernetes technique:chained vuln:auth-bypass vuln:misconfiguration vuln:privilege-escalation

**Target:** GKE Autopilot managed Kubernetes nodes / compute metadata service
**Root cause:** Nodes pull project-wide SSH keys from compute metadata and allow SSH tunneling despite setting user shells to /sbin/nologin, letting a user with compute.projects.setCommonInstanceMetadata reach the node metadata service normally gated by the GKE metadata server.
**Steps:**
1. Create Autopilot cluster; `kubectl get node -o wide` to get node IPs
2. Set project-wide SSH key at console.cloud.google.com/compute/metadata/sshKeys
3. Run `socks.sh <username> <node IP>` to open SOCKS proxy to node
4. Via proxy, fetch `kube-env` from node metadata service
5. Extract TPM key and cert from kube-env
6. Create CSR with `OU=system:masters CN=kubernetes-admin` (exempt from Autopilot gatekeeper)
7. Submit CSR to Kubernetes API using TPM key/cert
8. Approve CSR as Kubernetes Engine Admin user
9. Use signed cert to launch privileged pod and compromise node
**How found:** Noticed Autopilot nodes pull SSH keys from compute metadata and that nologin shells don't restrict SSH tunneling; hypothesized a SOCKS proxy could reach the node metadata service and enable the classic kubelet bootstrap attack.
**Exploitation:** Attacker with compute.projects.setCommonInstanceMetadata adds a project SSH key, opens a SOCKS tunnel to the node (nologin shell doesn't block tunneling), reaches the node metadata service bypassing the GKE metadata server, steals kubelet TPM credentials, forges a system:masters CSR, gets it approved, and launches a privileged pod to read all cluster secrets.
**Escalation:** Chained metadata access -> TPM credential theft -> CSR forgery as system:masters -> privileged pod -> node compromise and access to all cluster secrets beyond provisioned scope.
**Insight:** When a managed platform blocks direct node login via nologin, check whether SSH port forwarding/tunneling is still permitted—tunnels can reach metadata endpoints the platform assumes are unreachable, and system:masters identities may be exempt from admission policies.