# Podspec merge over hardened security fields

User-supplied podspec or env merged over admin-set securityContext, capabilities, or secrets

_Area: Cloud and container security. Seen in 2 disclosed reports; latest 2026-06-30. Updated 2026-11-01._

## How it works

A controller builds a workload by merging a user-supplied podspec (or env list) into a template it controls. The merge is field-by-field and unfiltered, so any field the user names wins over the admin's hardened defaults. The assumption that breaks: "the controller owns the security-relevant fields, users only supply the harmless ones." Nothing enforces that split, so `privileged`, `hostPID`, `hostNetwork`, `serviceAccountName`, or a plaintext secret value flow straight through [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx55-f84r-v3r7.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v.md). A second shape: a privileged host process inherits the container's environment and working directory, so a variable the image author set (`LD_PRELOAD`) is honored by code running outside the container [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape.md).

## Where it shows up

- CRDs that embed a `podSpec` (runtime, builder, scaler, trigger) and merge it into a generated Deployment or Pod [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx55-f84r-v3r7.md)[E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v.md)
- Merge helpers with no allowlist: `MergePodSpec`, generic struct merges, `mergo`-style overlays [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v.md)
- `Validate()` methods that check shape but not `hostPID`/`hostNetwork`/`hostIPC`/`privileged`/`serviceAccountName` [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx55-f84r-v3r7.md)
- Controllers resolving user-referenced Secrets under their own cluster-wide RBAC and writing values as `EnvVar.Value` [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v.md)
- OCI `createContainer` hooks (not `prestart`) that inherit container env and run with cwd at the container rootfs [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape.md)
- Any privileged host binary reachable with attacker-influenced `LD_PRELOAD`/`LD_LIBRARY_PATH` [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape.md)

## How to review

The invariant: every security-relevant field in the final workload is set by the controller, never by user input. Concretely, check that the merge uses an explicit allowlist of user-settable fields, and that `securityContext`, capabilities, host namespaces, `serviceAccountName`, volumes, and image are overwritten after the merge, not before. For secrets, confirm the pod resolves them via `ValueFrom.SecretKeyRef` under its own identity rather than the controller reading them under cluster-wide RBAC [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v.md). For hooks, confirm the privileged process runs with a scrubbed environment and a cwd outside the container rootfs [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape.md). Also check whether the target namespace carries PSA enforce labels — they can blunt a bad merge [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx55-f84r-v3r7.md).

## How finders spotted it

- Re-examined OCI hook semantics after earlier escape findings and noticed `createContainer` hooks inherit container env and run at the container rootfs, suggesting `LD_PRELOAD` abuse [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape.md)
- Code-read the scaler manager and saw `getEnvVarlist` resolving secrets under the controller's RBAC while `MergePodSpec` accepted user fields with no allowlist [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v.md)

## Impact and severity

High to critical. A namespace user with only CRD-write RBAC reached node compromise, then cluster takeover via stolen metadata credentials and the runtime socket [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-gx55-f84r-v3r7.md). A narrow trigger-create permission became namespace-wide secret read plus arbitrary workload execution [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v.md). On shared GPU hosts, host-root escape exposed other tenants' models and data [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape.md). Impact scales with what the merged pod can reach: host namespaces and node identity raise it from namespace to cluster.

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-nvidia-ai-vulnerability-cve-2025-23266-nvidiascape.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-gx55-f84r-v3r7.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-7m8x-qg2j-4m3v.md