# Identity checked only at registration

Node or workload identity validated at first join but not re-verified on restart or re-registration

_Area: Cloud and container security. Seen in 3 disclosed reports; 3 confirmed bounties, median $1,337, range $1,337-$10,000; latest 2022-04-14. Updated 2026-10-25._

## How it works
A platform validates a node or workload's identity once, when it first registers or joins. The assumption is that this check stays true for the life of the object. But registration is a repeatable event: a node can restart, re-register, or be replaced, and the identity material (metadata, keys, proxy headers) can change between events. If the platform trusts the earlier validation and skips re-checking on the later event, an attacker who can edit that material gets authorized without ever passing the original check.

## Where it shows up
- Registration/join code that calls an authorization check, and a separate restart/re-register path that does not.
- Identity carried in mutable metadata (custom metadata, proxy-user fields, SSH keys) rather than in signed credentials.
- Low-privilege roles that retain key-listing rights on resources whose keys are themselves authentication material.
- Managed platforms that block direct login (e.g. nologin shells) but still permit SSH tunneling or port forwarding.
- Parallel authorization paths (metadata, proxy headers, side-channel allowlists) that bypass IAM/Org Policy entirely.

## How to review
Find every path that (re)establishes a node or workload identity: first join, restart, re-registration, replacement. For each, confirm the same authorization check runs against the current identity material, not a cached result. The invariant: authorization must be re-evaluated on every registration event, and the identity material must be immutable or signed by the platform. Also check that any key readable at a low-privilege role cannot itself grant node/agent registration, and that blocked-login nodes cannot tunnel to metadata endpoints the platform assumes are unreachable.

## Variants seen
- GKE Autopilot nodes trust project-wide SSH metadata; nologin shells don't stop tunneling to node metadata, yielding kubelet creds and cluster-admin [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559c.md).
- Azure Automation Reader retains ListKeys; the AA key alone registers an arbitrary Hybrid Worker that polls JRDS for credentials [E2](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md).
- AI Notebooks validate proxy-user-mail actAs only at creation; editing metadata and restarting re-registers with the Inverting Proxy, bypassing org policy [E3](https://bugbountylibrary.com/r/blog%3Akattraxler-github-io-gcp-hacking-2021-09-10-gcp-org-policy-bypass-ai-notebooks-html.md).

## Impact and severity
Escalation to cluster-admin [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559c.md), Contributor-level credential theft [E2](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md), and cross-domain access bypassing iam.allowedPolicyMemberDomains [E3](https://bugbountylibrary.com/r/blog%3Akattraxler-github-io-gcp-hacking-2021-09-10-gcp-org-policy-bypass-ai-notebooks-html.md). Severity is high because the bypass needs only low-privilege rights (metadata write, Reader, actAs at creation) and yields durable credentials. Worse when the platform's own isolation assumptions (nologin, org policy) are what the attacker routes around.

## Why fixes fail
Blocking direct login without blocking tunneling leaves the metadata path open [E1](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559c.md); org policy constrains IAM but not parallel authorization paths [E3](https://bugbountylibrary.com/r/blog%3Akattraxler-github-io-gcp-hacking-2021-09-10-gcp-org-policy-bypass-ai-notebooks-html.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559c.md
- E2: https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md
- E3: https://bugbountylibrary.com/r/blog%3Akattraxler-github-io-gcp-hacking-2021-09-10-gcp-org-policy-bypass-ai-notebooks-html.md