# User patch overrides hardened pod security context

Check whether user-supplied patches or podspec fields merge over admin-set securityContext, capabilities, or namespace sharing

_Area: Cloud and container security. Seen in 3 disclosed reports; latest 2026-07-28. Updated 2026-10-25._

## How it works
A platform hardens a workload by setting `securityContext`, capabilities, or namespace flags in an admin-controlled template, then accepts a user-supplied patch or podspec that is merged into the final spec. The merge gives the user's value priority, so the hardened field is silently replaced. The platform's safety check validates only schema shape (is this a valid PodSpec?) or checks a fixed denylist, not the security-relevant outcome. The assumption that breaks: "the template's security settings survive submission." They do not, because merge precedence favors the submitter.

## Where it shows up
- Merge code where user spec outranks template spec (e.g. Workflow > WorkflowTemplate priority) [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-3wf5-g532-rcrr.md)
- Plain-string patch fields (`podSpecPatch`) applied after template hardening, validated only for JSON/PodSpec validity [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-3wf5-g532-rcrr.md)
- "Strict" or "restricted" modes that check only that a template reference exists, not what the merged result contains [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-3wf5-g532-rcrr.md)
- Admission controllers that block some dangerous fields but not `shareProcessNamespace` or arbitrary `runAsUser` [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md)
- Capability checks written as a short denylist instead of an allowlist [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qf5v-m7p4-95rp.md)
- Any user-controllable field that merges into the final pod spec: overrides, patches, annotations

## How to review
The invariant: after all merges, the final pod spec must satisfy the platform's security policy, and no user-controlled field may set or widen a security-relevant attribute the template fixed. Check that validation runs on the merged result, not the inputs. Confirm security fields are allowlisted (only known-safe values accepted), not denylisted. For capabilities, compare against the full kernel set and OCI defaults, not a hand-picked list [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qf5v-m7p4-95rp.md). For namespace sharing and UID, block `shareProcessNamespace` and pin `runAsUser` away from sidecar/service UIDs [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md).

## Variants seen
- Patch field overrides template securityContext, yielding privileged root pods with host mounts [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-3wf5-g532-rcrr.md)
- Admission controller permits `shareProcessNamespace` and arbitrary UID, escaping sidecar network isolation [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md)
- Incomplete capability denylist omits `CAP_SYS_TIME`, allowing node clock corruption [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qf5v-m7p4-95rp.md)

## Why fixes fail
E3 shows a denylist fix: adding entries still cannot cover OCI default-granted capabilities or the full kernel set, so the class persists.

## Impact and severity
Full cluster takeover and cross-tenant secret theft [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md); privileged root pods with host filesystem access [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-3wf5-g532-rcrr.md); cross-tenant node clock corruption [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-qf5v-m7p4-95rp.md). Severity is high because one tenant's patch reaches shared infrastructure. Worse when internal services trust the network with no auth [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md) and when "strict" modes give false assurance [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-3wf5-g532-rcrr.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-sapwned-sap-ai-vulnerabilities-ai-security.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-3wf5-g532-rcrr.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-qf5v-m7p4-95rp.md