# GKE Autopilot Node Compromise via Race Condition

Race during GKE Autopilot OPA policy provisioning lets a pod-creating user deploy a privileged pod and escape to the managed node.

- Payout: $1,337
- Severity: high
- Program: Google
- Credited: Anthony Weems
- Disclosed: 2021-04-01
- Write-up quality: 8/10
- Original: https://lf.lc/vrp/181521559d/
- Library page: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d
- Tags: domain:cloud impact:data-leak impact:privesc kind:bounty platform:blog sev:high tech:kubernetes technique:race-window technique:recon vuln:misconfiguration vuln:privilege-escalation vuln:race-condition

**Target:** GKE Autopilot admission control (OPA Gatekeeper) during cluster provisioning
**Root cause:** OPA/Gatekeeper policies enforcing Autopilot restrictions are provisioned asynchronously after the API server accepts requests, so resources created before enforcement is active are admitted without validation.
**Steps:**
1. Create an Autopilot cluster.
2. Loop `gcloud container clusters get-credentials $name` until credentials work.
3. Loop `timeout 1 kubectl apply -f deploy.yaml` (privileged pod with hostPath) until it succeeds.
4. Observe early failures: connection refused, 'request was sent before policy enforcement is enabled', gatekeeper webhook dial tcp [::1]:8787.
5. After a few minutes the privileged deployment is admitted.
6. `kubectl exec -it deploy/priv -- nsenter --mount=/proc/1/ns/mnt -- /bin/bash` to enter node mount namespace.
**How found:** Noticed admission errors revealing policy enforcement is enabled asynchronously ('request was sent before policy enforcement is enabled', gatekeeper webhook unreachable), hypothesizing a window before enforcement where malicious resources are admitted.
**Exploitation:** Attacker with pod/PV create rights races resource creation against policy provisioning; once the privileged pod with hostPath is admitted, nsenter into the node mount namespace yields root on the managed node, enabling reading all cluster secrets and querying the node metadata service for the default compute service account token.
**Escalation:** From privileged pod to node root, then to cluster-wide secret access and GCP default compute SA token via metadata service; multiple variants (a-d) reported.
**Insight:** When a managed platform bootstraps its admission policies asynchronously, hammer resource creation during cluster provisioning to land objects before the validating webhook is live; error messages like 'sent before policy enforcement is enabled' confirm the race window.