# Admission policy applied after creation

Enforcement (webhook, policy, allowlist) that goes live or is checked after the resource it should gate is already admitted

_Area: Cloud and container security. Seen in 3 disclosed reports; 2 confirmed bounties: $1,337 and $2,000; latest 2023-03-05. Updated 2026-11-01._

## How it works
A control plane is supposed to reject a resource *before* it exists. Here the gate is either not yet live, not given the real prior state, or skipped on a particular code path — so the resource is admitted, and the policy only catches the next one. The broken assumption is "if the policy exists, everything that exists passed it." In practice admission is a moment in time, and anything created outside that moment (during bootstrap, on a sharded path, or judged against a doctored `oldObject`) never meets the gate.

## Where it shows up
- Managed clusters/platforms that install validating webhooks asynchronously during provisioning; error text like "request was sent before policy enforcement is enabled" or webhook-unreachable [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md).
- Admission webhooks that diff `oldObject` vs `newObject` on core resources (Node, and similar) [E2](https://bugbountylibrary.com/r/h1%3A1095612.md).
- Controllers with feature flags that change the code path where an allowlist is enforced (sharding, apps-in-any-namespace) [E3](https://bugbountylibrary.com/r/h1%3A1847140.md).
- Any allowlist/glob check that lives in one controller path but not its sharded sibling [E3](https://bugbountylibrary.com/r/h1%3A1847140.md).

## How to review
The invariant: **every persisted object was validated against the policy in force at creation, using its true prior state.** Check each of:
- Is the gate synchronous with admission, or can objects land before the webhook is registered? Look for a readiness signal that clients can observe and a window before it.
- For webhooks: does `oldObject` actually carry pre-update values for this resource kind? Test a patch and compare.
- For allowlists: is the check present on *every* code path the feature flags select, not just the default one?
- Does a privileged outcome (privileged pod, node access) depend only on admission, with no second enforcement layer?

## How finders spotted it
- Read admission error messages revealing enforcement is enabled asynchronously, then hypothesized a pre-enforcement window [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md).
- Wrote a Node validating webhook, noticed `oldObject` matched the new object after a patch, traced it to the validation code path [E2](https://bugbountylibrary.com/r/h1%3A1095612.md).
- Enabled two features together and tested whether the namespace allowlist was still enforced, finding the sharded controller reconciled a non-matching namespace [E3](https://bugbountylibrary.com/r/h1%3A1847140.md).

## Variants seen
- Bootstrap race: policy provisioned after API server accepts requests [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md).
- Stale/incorrect `oldObject` in AdmissionReview defeating webhook diffs [E2](https://bugbountylibrary.com/r/h1%3A1095612.md).
- Feature-flag code path skipping the allowlist check [E3](https://bugbountylibrary.com/r/h1%3A1847140.md).

## Impact and severity
E1 escalated from a privileged pod to node root, cluster-wide secrets, and the cloud default compute service-account token via metadata — high severity because admission was the only barrier and escape chained to cloud identity [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md). E2 let users steer workloads, evict pods, and block scheduling cluster-wide [E2](https://bugbountylibrary.com/r/h1%3A1095612.md). E3 allowed deploying resources outside permitted namespaces [E3](https://bugbountylibrary.com/r/h1%3A1847140.md). Impact rises when the bypassed gate is the sole control before a privileged or cross-tenant boundary.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md
- E2: https://bugbountylibrary.com/r/h1%3A1095612.md
- E3: https://bugbountylibrary.com/r/h1%3A1847140.md