# Tenant-reachable control plane credential leak

Can a tenant workload or low-privileged role reach host or control-plane endpoints that return cluster credentials or CA keys?

_Area: Cloud and container security. Seen in 4 disclosed reports; 2 confirmed bounties: $1,337 and $2,500; latest 2026-10-15. Updated 2026-10-23._

## How it works
A managed platform assumes that tenant workloads and low-privileged roles cannot reach the host or control plane, and that anything reachable from inside a tenant container is safe to expose. That assumption breaks when a tenant-reachable endpoint (a metadata service, a local host service, a state bucket, a project-wide metadata attribute) returns a credential or key that the platform itself uses. The tenant then holds an identity stronger than its own, and the isolation boundary between tenant and platform (or tenant and tenant) collapses.

## Where it shows up
- A container runtime that runs as root or with host access, where a sibling runtime does not [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough.md).
- Local firewall rules that block specific internal IPs — treat those IPs as a map to sensitive services [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough.md).
- Instance metadata reachable from a pod, returning the node's service account token [E3](https://bugbountylibrary.com/r/h1%3A1842829.md).
- A state store or bucket holding cluster PKI that the node identity can read [E3](https://bugbountylibrary.com/r/h1%3A1842829.md).
- A tenant-controlled address or URL field that the operator later sends its own credential to [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-637c-6jxx-4rwm.md).
- Managed nodes with no instance-level metadata override, falling back to project-wide values [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559b.md).

## How to review
The invariant: no credential or key that grants platform or cluster authority may be reachable by, or issuable to, a tenant workload or low-privileged role. Check each hop: can the tenant reach the endpoint; does the endpoint return a secret; does that secret grant more than the tenant already had. For operator components, confirm tenant-controlled fields (addresses, URLs) cannot cause the operator to present its own identity [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-637c-6jxx-4rwm.md). For cluster tooling, confirm the node identity cannot read the CA private key or state store [E3](https://bugbountylibrary.com/r/h1%3A1842829.md). For managed nodes, confirm instance-level metadata is set and does not inherit project-wide values [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559b.md).

## Variants seen
- Root container plus bypassable local firewall exposing host services and a certificate bundle [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough.md).
- Operator sends its cluster-privileged token to a tenant-supplied address [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-637c-6jxx-4rwm.md).
- Node service account reads the state bucket holding the cluster CA key [E3](https://bugbountylibrary.com/r/h1%3A1842829.md).
- Missing instance metadata override lets a weaker IAM role inject a project-wide startup script [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559b.md).

## Why fixes fail
A content filter on a credential can be satisfied by the operator's own token by construction, so validating that bytes are a JWT with a service-account subject does not stop the leak [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-637c-6jxx-4rwm.md).

## Impact and severity
Full cluster admin [E2](https://bugbountylibrary.com/r/ghsa%3AGHSA-637c-6jxx-4rwm.md)[E3](https://bugbountylibrary.com/r/h1%3A1842829.md), cross-tenant primary key theft [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough.md), and read of all cluster secrets [E4](https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559b.md). Severity is high because the leaked identity outranks the tenant's own; it worsens when the credential is long-lived or shared across tenants [E1](https://bugbountylibrary.com/r/blog%3Awiz-io-blog-chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough.md).

## Evidence
- E1: https://bugbountylibrary.com/r/blog%3Awiz-io-blog-chaosdb-explained-azures-cosmos-db-vulnerability-walkthrough.md
- E2: https://bugbountylibrary.com/r/ghsa%3AGHSA-637c-6jxx-4rwm.md
- E3: https://bugbountylibrary.com/r/h1%3A1842829.md
- E4: https://bugbountylibrary.com/r/blog%3Alf-lc-vrp-181521559b.md