# Over-privileged shared credentials lateral movement

Readable keys, tokens, or shared runtime contexts that authenticate or act at higher privilege elsewhere

_Area: Cloud and container security. Seen in 4 disclosed reports; one confirmed bounty: $10,000; latest 2026-10-16. Updated 2026-10-23._

## How it works
A platform assumes a credential, key, or runtime namespace is scoped to one service, tenant, or role. The assumption breaks when that same material is reachable from a lower-privileged position and is broad enough to act elsewhere. The attacker reuses a shared secret or shared runtime context the platform already trusts, rather than defeating isolation directly. The invariant that fails: material readable at privilege level X must not grant capabilities above X [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md)[E3](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md)[E4](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md). Two related shapes appear: a credential that is over-scoped or over-readable [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r.md)[E4](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md), and a credential that is legitimately powerful but has no tenant boundary, so compromise or addition of it reaches every tenant that trusts it [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md)[E3](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md). E1 is a chain, not a single credential: runtime isolation gaps plus over-scoped registry credentials together reach cross-tenant data.

## Where it shows up
- Registry pull credentials carrying push/write scope, or service-account tokens mounted into workloads that only need read [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r.md)
- Low-privilege roles (Reader) that still carry ListKeys on resources whose keys are authentication material [E4](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md)
- Agent/node registration endpoints where a readable key alone is sufficient to register a new node [E4](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md)
- Credentials on a parent object (blueprint, app registration) that authenticate every child identity across tenants [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md)[E3](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md)
- Adjacent runtime-isolation gaps that widen the blast radius: pods sharing PID namespaces or writable home mounts across tenants [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r.md)

## How to review
For each credential, key, and namespace, ask: who can read it, and what can it authenticate to? Check that registry tokens are pull-only where push is not needed, that ListKeys is not bundled into read-only roles, that node registration requires an identity distinct from a readable key, and that parent-object credentials do not span tenants [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r.md)[E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md)[E3](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md)[E4](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md). For multi-tenant apps, confirm the credential is bound to a tenant or infrastructure identity, not usable from anywhere [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md)[E3](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md).

## Variants seen
- Over-scoped registry push credentials, chained with shared PID namespaces and writable mounts to cross-tenant data and image overwrite [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r.md)
- Reader role retaining ListKeys; key alone registers an arbitrary Hybrid Worker that polls for credentials [E4](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md)
- Vendor app credential minting tokens across 300+ consenting tenants [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md)
- Blueprint credential authenticating all affiliated agent identities in any tenant [E3](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md)

## Impact and severity
Reached cross-tenant data and supply-chain image overwrite [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r.md), Contributor escalation from Reader [E4](https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md), and Global Admin across tenants [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md)[E3](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md). Severity rises when the shared credential is both broadly readable and broadly powerful, and when it has no tenant boundary at all [E2](https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md)[E3](https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-brokensesame-accidental-write-permissions-to-private-registry-allowed-potential-r.md
- E2: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-vendor-credential-enables-unauthorized-access.md
- E3: https://bugbountylibrary.com/r/blog%3Asecuritylabs-datadoghq-com-articles-agent-id-inside-agent-compromise.md
- E4: https://bugbountylibrary.com/r/blog%3Anetspi-com-blog-technical-cloud-penetration-testing-abusing-azure-hybrid-workers-part-2.md