# Admission check inspects wrong object

Security check reads a partial struct, stale oldObject, or one alias while an equivalent field reaches the backend unguarded

_Area: Cloud and container security. Seen in 3 disclosed reports; latest 2026-05-14. Updated 2026-10-25._

## How it works
A security control must inspect the exact object the backend will act on. It breaks when the control reads a different representation than the one enforced downstream: a partial struct that drops fields, an `oldObject` that is not the pre-update state, or one field name where the backend accepts several aliases. The check passes, the backend still honors the unread field, and the restriction is bypassed.

## Where it shows up
- Proxy or webhook unmarshals a request body into a partial struct before validating, then forwards the original body [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7fw3-x4r2-g7wc.md).
- Admission logic diffs `oldObject` vs new object, but the resource's validation path populates `oldObject` from the new object [E2](https://bugbountylibrary.com/r/h1%3A1095612.md).
- A restriction checks one field (`HostConfig.Binds`) while an equivalent array (`HostConfig.Mounts`) is accepted by the daemon [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7fw3-x4r2-g7wc.md).
- Privilege fields (`CapabilityAdd`, `Privileges`, `Sysctls`, seccomp) absent from the validating struct but present in the backend schema [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md).
- Checks applied on one route (container create) but not the parallel route (Swarm service create/update) [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7fw3-x4r2-g7wc.md).

## How to review
The invariant: every field the backend enforces on must be parsed and validated by the control, and the object validated must be the object executed. Concretely:
- Enumerate the backend's full schema and confirm each security-relevant field appears in the validating struct; undeclared fields are invisible but still forwarded [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md).
- For each capability, list all accepted aliases and confirm all are checked [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7fw3-x4r2-g7wc.md).
- For admission webhooks, confirm `oldObject` is genuinely pre-update for that resource, not copied from the new object [E2](https://bugbountylibrary.com/r/h1%3A1095612.md).
- Compare check coverage across equivalent routes; count how many checks fire per path [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md).

## Variants seen
- Partial-struct field omission in a proxy [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md).
- Stale/incorrect `oldObject` in validating admission [E2](https://bugbountylibrary.com/r/h1%3A1095612.md).
- Alias field bypass (`Binds` vs `Mounts`) [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7fw3-x4r2-g7wc.md).
- Route-level gap: checks on one API path, none on a parallel one [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7fw3-x4r2-g7wc.md).

## Impact and severity
High: bypasses let non-admin users gain host root via `CAP_SYS_ADMIN`, unconfined seccomp, or host bind mounts reaching the Docker socket [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7fw3-x4r2-g7wc.md), and defeat webhook restrictions on node labels, taints, and schedulability [E2](https://bugbountylibrary.com/r/h1%3A1095612.md). Severity rises when the unguarded field grants host-level privilege and when the same gap spans multiple routes.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-5fxq-qcf3-244w.md
- E2: https://bugbountylibrary.com/r/h1%3A1095612.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-7fw3-x4r2-g7wc.md