# Node Validation Admission does not observe all oldObject fields

Kubernetes Node validating admission webhook receives oldObject populated with new values, letting users bypass webhook restrictions on node labels, taints, and schedulability.

- Payout: hidden
- Severity: medium
- Program: Kubernetes
- Found by: ariellima
- Disclosed: 2021-09-05
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1095612
- Library page: https://bugbountylibrary.com/r/h1%3A1095612
- Tags: area:cloud domain:cloud impact:integrity impact:privesc kind:bounty platform:hackerone sev:medium tech:kubernetes technique:source-review vuln:access-control vuln:auth-bypass

**Target:** kube-apiserver Node validating admission webhook (AdmissionReview oldObject)
**Root cause:** The Node validation path copies the new object's fields into oldObject before invoking validating admission webhooks, so oldObject reflects the patched values instead of the pre-update state.
**Steps:**
1. Create a ValidatingWebhookConfiguration matching Node UPDATE operations.
2. Deploy a webhook that logs oldObject and newObject from AdmissionReview.Request.
3. Patch a Node field such as metadata.labels, spec.taints, or spec.unschedulable.
4. Observe that the patched value appears in both oldObject and newObject, so webhook diff-based restrictions never trigger.
**How found:** Researcher wrote a Node validating webhook and noticed oldObject in the AdmissionReview matched the new object after a patch; traced to the Node validation code path that populates oldObject.
**Exploitation:** A user with node update permission patches labels/taints/unschedulable; the validating webhook sees oldObject equal to newObject and permits the change, bypassing policy that intended to block those mutations.
**Escalation:** Changing labels can steer workloads to attacker-chosen nodes; taints can evict pods; unschedulable can block scheduling cluster-wide.
**Insight:** When building admission webhooks that diff old vs new, verify oldObject is actually the pre-update state for the specific resource; core resources may populate oldObject from the new object in validation paths, silently defeating diff-based policy.