# Workload token sent to user-controlled endpoint

Service-account or API token auto-attached to a URL, host, or server the tenant or policy author controls

_Area: Cloud and container security. Seen in 3 disclosed reports; latest 2026-05-21. Updated 2026-11-01._

## How it works
A component holds a privileged identity (a Kubernetes service-account token, a system-configured API token) and makes an outbound request on behalf of user-authored input. The assumption that breaks is "the destination is trusted." When the destination URL, host, or server is tenant- or policy-controlled, the platform's own credential is attached to a request the attacker receives. The confused deputy is the platform: it acts with its identity, but the attacker chose where the request goes.

## Where it shows up
- A pod sets `ServiceAccountName` to a privileged SA, and untrusted code runs in a container in that same pod [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-85g2-pmrx-r49q.md).
- Resolver or client code takes a `serverURL`/host/registry from user params and does not compare it to the system-configured value [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md).
- A credential fallback: when the user omits a token param, the system secret is used instead [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md).
- Outbound HTTP helpers that add an `Authorization` header implicitly when none is present [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q93q-v844-jrqp.md).
- Policy or config engines (admission controllers, resolvers) that call URLs supplied by policy authors [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q93q-v844-jrqp.md)[E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md).

## How to review
Find every place a privileged credential is attached to an outbound request, then ask who controls the destination. The invariant: a platform credential may only be sent to a destination fixed by the platform, never to one derived from tenant or policy input. Check:
- Is the destination compared against an allowlist or the system-configured value before the credential is added? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md)
- Does the credential get attached implicitly (no explicit header) rather than only on explicit opt-in? [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q93q-v844-jrqp.md)
- For pods: does the privileged SA's token mount into containers running untrusted code? Prefer per-container token suppression via projected volumes over pod-wide `ServiceAccountName` [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-85g2-pmrx-r49q.md).
- Does an omitted credential param silently fall back to the system secret? [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md)

## How finders spotted it
- Read runtime pod specs and the SA's RBAC together, noticing the fetcher SA is pod-wide and its token is reachable from the user container [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-85g2-pmrx-r49q.md).
- Traced how `serverURL` and the token fallback interact when the token param is absent, reusing a prior advisory's threat model [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md).
- Read the apiCall executor's header handling, spotted the implicit Authorization injection, then confirmed with an in-cluster receiver and a negative control [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q93q-v844-jrqp.md).

## Variants seen
- Pod-level SA token automounted into a user function container [E1](https://bugbountylibrary.com/r/ghsa%3AGHSA-85g2-pmrx-r49q.md).
- System API token sent to a user-supplied `serverURL` via credential fallback [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md).
- Implicit bearer-token injection into policy-controlled URLs [E3](https://bugbountylibrary.com/r/ghsa%3AGHSA-q93q-v844-jrqp.md).

## Impact and severity
All three leak a platform credential to attacker-chosen destinations. Impact scales with the RBAC bound to that identity: E1's harvested secrets enable lateral movement to other Kubernetes resources and external systems; E3's token can be replayed against the Kubernetes API, scaling with the controller SA's permissions. E2 exfiltrates a shared PAT. Severity rises with how broad the credential's reach is and whether the attacker can trigger the request repeatedly.

## Evidence
- E1: https://bugbountylibrary.com/r/ghsa%3AGHSA-85g2-pmrx-r49q.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-wjxp-xrpv-xpff.md
- E3: https://bugbountylibrary.com/r/ghsa%3AGHSA-q93q-v844-jrqp.md