# Admission controller restriction bypass

Webhooks that trust image/command strings, oldObject, shared namespaces, or UID, or run before policy is live

_Area: Cloud and container security. Seen in 6 disclosed reports; 3 confirmed bounties, median $1,337, range $1,337-$4,134; latest 2024-07-17. Updated 2026-10-23._

## How it works
An admission controller is the only thing standing between a tenant and a privileged pod, so its checks must actually bind the thing being admitted. These bypasses happen when the check inspects a proxy for the real property: an image/command string instead of the binary that runs [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-gke-autopilot-vulnerabilities.md), a UID or namespace flag that the controller never blocks [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md), an `oldObject` that the API server filled with new values [E3](https://bugbountylibrary.com/r/h1%3A1095612.md), or a policy that is provisioned asynchronously after requests are already accepted [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md). In each case the assumption "the webhook saw the real request" or "the webhook was enforcing" is false.

## Where it shows up
- Allowlist rules matching `image` and `command`/`args` strings rather than the resolved entrypoint or binary [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-gke-autopilot-vulnerabilities.md)
- Exempt namespaces or service accounts (e.g. `kube-system`) fully skipped by policy [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-gke-autopilot-vulnerabilities.md)
- Pod specs setting `shareProcessNamespace: true` or arbitrary `runAsUser`/UIDs under a sidecar-enforced network policy [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md)
- Webhooks that diff `oldObject` vs new object on core resources like Node [E3](https://bugbountylibrary.com/r/h1%3A1095612.md)
- Managed clusters where Gatekeeper/OPA webhooks come up after the API server accepts creates; errors like "request was sent before policy enforcement is enabled" [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md)

## How to review
For each restriction, ask: does the check bind the actual runtime artifact, and is it guaranteed active? The invariant: every admitted object either satisfies the policy on its true runtime properties, or is rejected; and no object is admitted while the policy is not yet live. Concretely: confirm allowlists resolve to the real binary/entrypoint, not just strings; confirm no namespace/SA is exempt from tenant-isolation rules; confirm `shareProcessNamespace`, `runAsUser`, and hostPath mounts are denied; confirm `oldObject` is genuinely pre-update for the resource in question; confirm policy webhooks are ready before the cluster serves tenant creates.

## Variants seen
- String-match allowlist spoofed by a different binary under the same image/command [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-gke-autopilot-vulnerabilities.md)
- Exempt system namespace/SA used to sidestep policy [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-gke-autopilot-vulnerabilities.md)
- Sidecar isolation defeated via shared process namespace and sidecar UID [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md)
- `oldObject` populated with new values, defeating diff-based webhooks [E3](https://bugbountylibrary.com/r/h1%3A1095612.md)
- Race window before asynchronous policy provisioning [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md)

## Why fixes fail
Fixes that only tighten the string match or add one denied field leave the other shapes open; the root cause is trusting a proxy or assuming enforcement is live, so each variant needs its own check.

## Impact and severity
Outcomes ranged from node escape and shadow cluster admin [E1](https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-gke-autopilot-vulnerabilities.md) to full cluster takeover and customer secret theft [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md), node compromise [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md), and label/taint bypass [E3](https://bugbountylibrary.com/r/h1%3A1095612.md). Severity is high because a single admitted pod crosses the tenant boundary; unauthenticated internal services trusting the network made it worse [E2](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aunit42-paloaltonetworks-com-gke-autopilot-vulnerabilities.md
- E2: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md
- E3: https://bugbountylibrary.com/r/h1%3A1095612.md
- E4: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559d.md