Dual Privilege Escalation Chain: Exploiting Monitoring and Service Mesh Configurations and Privileges in GKE to Gain Unauthorized Access in Kubernetes
Summary: Unit 42 researchers chained two GKE default configurations: FluentBit's hostPath mount of /var/lib/kubelet/pods, which exposes every pod's projected service account token on a node, and the excessive post-install permissions of the Anthos Service Mesh Istio-cni-node DaemonSet. An attacker who already has code execution in the FluentBit container can harvest tokens, create a pod in the kube-system namespace bound to the clusterrole-aggregation-controller service account, and escalate to cluster admin; Google fixed both issues on Dec. 14, 2023, under GCP-2023-047.
Key Takeaway: The escalation depended on system pods the customer never configured and cannot control - FluentBit runs by default on every node since Milestone 105, and the ASM CNI DaemonSet keeps cluster-wide permissions after installation. A single foothold in a logging container was enough to reach cluster admin, which carries data theft, malicious pods, and operational disruption.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Data Breaches
- Related
- TSMC employee data breach linked to cloud provider Cyber Risks · Nov 15, 2026Data Breach at La Poste Subsidiary Maileva Affects 22 Million People in France Cyber Risks · Nov 15, 2026City of Osaka warns of data breach impacting 1 million as Japan reels from dozens of cyber incidents Cyber Risks · Nov 13, 2026