---
name: cloud-and-container-security
description: "Guides a reviewer through assessing a cloud platform's identity, tenancy, and workload isolation boundaries (IAM trust, metadata credentials, containers/Kubernetes, serverless) using a checklist of known weakness classes."
---

# Cloud and container security

Breaking a cloud platform's own isolation and identity: IAM and role trust, instance metadata and workload credentials, cross-tenant isolation, containers and Kubernetes, serverless runtimes. A web bug (XSS, CSRF, OAuth, subdomain takeover) on a cloud company's website belongs to the web areas.

_From Bug Bounty Library (https://bugbountylibrary.com): generated from disclosed, accepted reports and updated as new ones land. Updated 2026-10-23._

## Approaching cloud and container isolation

You are testing whether a cloud platform's own boundaries hold: identity, tenancy, and workload isolation. Stay on the authorized target and scope; this is about finding where the platform trusts something it shouldn't.

**Map first.** Identify the control plane and data plane: IAM roles and their trust policies, instance/workload metadata endpoints, the container runtime and orchestrator (Kubernetes API, admission webhooks, CNI), serverless runtimes, and any shared storage or registry. Note what is user-controlled versus operator-controlled, and where those meet.

**Ask these questions:**
- Who can assume which role, and does the trust policy check the right principal and conditions?
- Can a workload reach metadata or internal endpoints it shouldn't, and are credentials scoped to it?
- Are user-supplied values (annotations, names, image strings, commands) templated into config or paths without escaping or exact matching?
- Do host-side file operations on container paths follow symlinks or re-resolve after checks?
- Do admission webhooks trust strings, oldObject, or run before policy is live?
- Does an operation on a referenced resource check permission on that resource's own scope?
- Do logs, CI artifacts, or served files contain secrets or full commands?
- Do shared namespaces, writable registries, or wildcard permissions allow lateral movement?

**Use the patterns below** as a checklist of known weakness classes. For each, trace the trust boundary it crosses, confirm reachability from your position, and record the minimal evidence that shows the boundary is broken. Prioritize patterns reachable without auth or from a low-privilege workload, since those demonstrate real isolation failure. Note anything you cannot confirm as a lead, not a finding.

## Patterns

Each pattern below has a full write-up (how it works, where it shows up, how to review for it, variants, impact), grounded in
real disclosed reports. Load the one you need from its link.

### Unauthenticated management service exposure
Admin, registry, notebook or dashboard ports reachable without auth, or internal RPCs reachable from user workloads

_9 reports · 5 confirmed bounties, median $3,134, up to $36,337._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/exposed-unauthenticated-service.md

### Container escape via symlink and mount races
Host-side file operations on container-controlled paths that follow symlinks or re-resolve paths after checks

_6 reports · 3 confirmed bounties, median $2,000._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/container-escape-mount-race.md

### Admission controller restriction bypass
Webhooks that trust image/command strings, oldObject, shared namespaces, or UID, or run before policy is live

_6 reports · 3 confirmed bounties, median $1,337, up to $4,134._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/admission-webhook-bypass.md

### SSRF to cloud metadata credentials
Server-side fetch or tunnel reaching 169.254.169.254 or internal metadata, leaking cloud credentials or tokens

_4 reports · 4 confirmed bounties, median $1,337, up to $25,000._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/ssrf-metadata-credential-theft.md

### Config injection via unsanitized annotations
User-controlled annotations templated into generated proxy config without escaping, letting values become directives

_4 reports · 2 confirmed bounties: $2,500 and $2,500._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/config-injection-annotation.md

### Shared storage path traversal
User-controlled names joined into storage paths without encoding or exact-key pinning

_4 reports · 2 confirmed bounties: $250 and $2,000._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/path-traversal-shared-namespace.md

### Over-privileged shared credentials lateral movement
Readable keys, tokens, or shared runtime contexts that authenticate or act at higher privilege elsewhere

_4 reports · one confirmed bounty: $10,000._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/overprivileged-shared-credentials.md

### Tenant-reachable control plane credential leak
Can a tenant workload or low-privileged role reach host or control-plane endpoints that return cluster credentials or CA keys?

_4 reports · 2 confirmed bounties: $1,337 and $2,500._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/tenant-reachable-control-plane-credential-leak.md

### Secrets leaked into logs and artifacts
Credentials or full request commands written to logs, CI artifacts, or web-served files

_3 reports · 2 confirmed bounties: $500 and $7,500._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/secret-exposure-logs-artifacts.md

### Missing authorization on resource scope
Operations that act on a referenced resource without checking permission on that resource's own scope

_2 reports · one confirmed bounty: $5,000._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/missing-authorization-scope.md

### Host network token sniffing
Shared host network lets pods reach or sniff other tenants' unauthenticated token and metadata endpoints

_2 reports._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/host-network-token-sniffing.md

### Config directive injection in generated proxy config
User fields templated into generated nginx/proxy config; check newline, brace, and directive breakout

_2 reports · 2 confirmed bounties: $2,500 and $2,500._
Full pattern: https://bugbountylibrary.com/skills/cloud-and-container-security/generated-config-directive-injection.md

## Rarer patterns

Seen only once or twice so far, so there is no full write-up yet; each links to the report that shows it.

- **Predictable bucket name squatting**: Storage bucket names derived predictably and trusted without ownership verification (https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-168991979.md)
- **Predictable secret generation**: PRNG seeded with time or truncated keys used for tokens, CA keys, or privileged messages (https://bugbountylibrary.com/r/blog%3Awiz-io-blog-omi-returns-lpe-technical-analysis.md)
- **Resource hijack via tag-based trust**: Controller treats any attacker-taggable resource as managed and rewrites its rules (https://bugbountylibrary.com/r/h1%3A1238017.md)
- **Service VIP or IP hijacking**: Controller programs external or loadbalancer IPs without validating overlap with existing addresses (https://bugbountylibrary.com/r/blog%3Agithub-com-champtar-blog-tree-main-k8s-mitm-loadbalancer-externalips.md)
- **CSRF via missing origin or token check**: State-changing endpoint lacks CSRF token or origin check, or SameSite=None cookies with loose regex (https://bugbountylibrary.com/r/blog%3Aermetic-com-blog-azure-emojideploy-smile-your-azure-web-service-just-got-rced.md)
- **Command injection via config values**: Config values (env names, versions, credential helpers) reaching shell or exec sinks without escaping (https://bugbountylibrary.com/r/blog%3Aorca-security-resources-blog-synlapse-critical-azure-synapse-analytics-service-vulnerability.md)
- **Confused deputy on client tenant id**: Client-supplied tenant, installation, zone or resource id trusted without an ownership check before acting on it (https://bugbountylibrary.com/r/h1%3A1952124.md)
- **Host path access via volume bypass**: Local-storage PV or volume types mounting node paths without hostPath restrictions (https://bugbountylibrary.com/r/h1%3A867699.md)
- **Malicious package startup hook**: Import-time or install-time code in packages, wheels, or images that runs before any application logic (https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape.md)
- **Namespace allowlist bypass**: Sharded controller reconciles apps outside configured glob or name-match check skipped (https://bugbountylibrary.com/r/h1%3A1847140.md)
- **SSRF allowlist parser differential**: Validator and HTTP client parse host differently, or redirects/DNS re-resolution escape the whitelist (https://bugbountylibrary.com/r/h1%3A859962.md)