# Unauthenticated management service exposure

Admin, registry, notebook or dashboard ports reachable without auth, or internal RPCs reachable from user workloads

_Area: Cloud and container security. Seen in 8 disclosed reports; 5 confirmed bounties, median $3,134, range $566-$36,337; latest 2023-07-11. Updated 2026-10-23._

## How it works
A service built to be driven by trusted operators is deployed with no authentication, or with authorization checks missing for some callers, and is reachable from a network that should not reach it. The broken assumption is that network position equals trust: the listener is assumed to sit behind a boundary that does not exist, or the caller is assumed to be a trusted internal component. Because these interfaces control execution, configuration or stored artifacts, whoever reaches them inherits that power. In managed clouds the same gap appears as internal RPCs exposed to user code in non-production environments but not production [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-36k-google-app-engine-rce-html.md).

## Where it shows up
- Registries answering on public IPs or on the container bridge/host address (e.g. 172.17.0.1:5000) [E3](https://bugbountylibrary.com/r/h1%3A347296.md)
- Notebook servers (Jupyter) reachable from the internet, with shell/subprocess available [E5](https://bugbountylibrary.com/r/blog%3Acarnal0wnage-attackresearch-com-2020-03-what-is-your-gcp-infra-worthabout-700-html.md)[E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-pyloose-first-python-based-fileless-attack-on-cloud-workloads.md)
- Workflow and CI dashboards (Argo, Jenkins) with no login [E4](https://bugbountylibrary.com/r/blog%3Atnirmal-com-np-2021-08-dropping-root-shell-in-crypto-exchange-html.md)
- Internal RPC/management endpoints reachable from user-controlled workloads, or localhost-only services reached through a chained primitive such as SSRF [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-36k-google-app-engine-rce-html.md)[E7](https://bugbountylibrary.com/r/blog%3Ambrancato-github-io-2021-12-28-rce-dataflow-html.md)
- Legacy API versions still enabled and unauthenticated when the current version is hardened [E2](https://bugbountylibrary.com/r/blog%3Aavicoder-me-2016-07-22-twitter-vine-source-code-dump.md)
- Default configs that ship auth off, or options that let a caller choose a binary path or interpreter [E4](https://bugbountylibrary.com/r/blog%3Atnirmal-com-np-2021-08-dropping-root-shell-in-crypto-exchange-html.md)

## How to review
For each management, registry, notebook or dashboard listener, establish the invariant: every request that can read artifacts, change config or cause execution must pass an authentication and authorization check before any action, regardless of source address. Check the deployed config, not the docs: is auth enabled, is the bind address loopback-only or behind a proxy, is the legacy API disabled, and can a workload in the same network reach it? For internal services, verify that user-controlled code cannot reach localhost management ports or metadata-adjacent RPCs, and that non-production environments enforce the same authorization as production [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-36k-google-app-engine-rce-html.md)[E7](https://bugbountylibrary.com/r/blog%3Ambrancato-github-io-2021-12-28-rce-dataflow-html.md). Treat any option that selects an executable or interpreter as an execution primitive requiring auth [E4](https://bugbountylibrary.com/r/blog%3Atnirmal-com-np-2021-08-dropping-root-shell-in-crypto-exchange-html.md).

## Variants seen
- Private registry with unauthenticated pull via the legacy V1 API, leaking source and secrets [E2](https://bugbountylibrary.com/r/blog%3Aavicoder-me-2016-07-22-twitter-vine-source-code-dump.md)
- Registry v2 over plain HTTP reachable from a build sandbox [E3](https://bugbountylibrary.com/r/h1%3A347296.md)
- Exposed notebook yielding command execution and credential theft [E5](https://bugbountylibrary.com/r/blog%3Acarnal0wnage-attackresearch-com-2020-03-what-is-your-gcp-infra-worthabout-700-html.md)[E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-pyloose-first-python-based-fileless-attack-on-cloud-workloads.md)
- Unauthenticated workflow dashboard creating privileged pods [E4](https://bugbountylibrary.com/r/blog%3Atnirmal-com-np-2021-08-dropping-root-shell-in-crypto-exchange-html.md)
- Internal RPC reachable from user apps in non-production environments [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-36k-google-app-engine-rce-html.md)
- Localhost-only JMX reached via a chained primitive on a managed worker [E7](https://bugbountylibrary.com/r/blog%3Ambrancato-github-io-2021-12-28-rce-dataflow-html.md)

## Impact and severity
Ranged from source and secret disclosure [E2](https://bugbountylibrary.com/r/blog%3Aavicoder-me-2016-07-22-twitter-vine-source-code-dump.md)[E5](https://bugbountylibrary.com/r/blog%3Acarnal0wnage-attackresearch-com-2020-03-what-is-your-gcp-infra-worthabout-700-html.md) to full code execution and cryptomining across hundreds of workloads [E6](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-pyloose-first-python-based-fileless-attack-on-cloud-workloads.md)[E4](https://bugbountylibrary.com/r/blog%3Atnirmal-com-np-2021-08-dropping-root-shell-in-crypto-exchange-html.md), with bounties up to $36k [E1](https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-36k-google-app-engine-rce-html.md). Severity rose where the service granted execution, where credentials sat nearby, and where the host was shared with other tenants or the build network [E3](https://bugbountylibrary.com/r/h1%3A347296.md)[E4](https://bugbountylibrary.com/r/blog%3Atnirmal-com-np-2021-08-dropping-root-shell-in-crypto-exchange-html.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Aezequiel-tech-p-36k-google-app-engine-rce-html.md
- E2: https://bugbountylibrary.com/r/blog%3Aavicoder-me-2016-07-22-twitter-vine-source-code-dump.md
- E3: https://bugbountylibrary.com/r/h1%3A347296.md
- E4: https://bugbountylibrary.com/r/blog%3Atnirmal-com-np-2021-08-dropping-root-shell-in-crypto-exchange-html.md
- E5: https://bugbountylibrary.com/r/blog%3Acarnal0wnage-attackresearch-com-2020-03-what-is-your-gcp-infra-worthabout-700-html.md
- E6: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-pyloose-first-python-based-fileless-attack-on-cloud-workloads.md
- E7: https://bugbountylibrary.com/r/blog%3Ambrancato-github-io-2021-12-28-rce-dataflow-html.md