--- title: How your cloud could get hacked: an analysis of a... description: A Kaspersky pentest of a major cloud provider's managed Kubernetes service uncovered a chain of flaws that let an external tenant take over the entire cloud.... canonical: https://daily.dev/posts/how-your-cloud-could-get-hacked-an-analysis-of-a-real-world-vulnerability-chain-fpulkynl5 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: How your cloud could get hacked: an analysis of a real-world vulnerability chain | daily.dev og:description: A Kaspersky pentest of a major cloud provider's managed Kubernetes service uncovered a chain of flaws that let an external tenant take over the entire cloud.... og:url: https://daily.dev/posts/how-your-cloud-could-get-hacked-an-analysis-of-a-real-world-vulnerability-chain-fpulkynl5 og:image: https://api.daily.dev/og/posts/FPuLKYNL5.png og:image:alt: How your cloud could get hacked: an analysis of a real-world vulnerability chain og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # How your cloud could get hacked: an analysis of a real-world vulnerability chain **[Securelist](https://daily.dev/sources/securelist)** · 16 min read · 0 upvotes · 0 comments ## Summary A Kaspersky pentest of a major cloud provider's managed Kubernetes service uncovered a chain of flaws that let an external tenant take over the entire cloud. Weak pod security policies allowed deploying a privileged pod and escaping to the host, where a found Konnectivity token enabled an SSRF into the control plane and RCE via D-Bus and systemd. Privilege escalation used a known OverlayFS bug (CVE-2023-32629) on Ubuntu 22.04. From there, a flat overlay network exposed other tenants' Kafka, Redis, and PostgreSQL instances, and a SQL injection in a custom SaltStack script exposed Salt master tokens that could control minions across the cloud. The case won second place at Russian Pentest Award 2026, and all issues were fixed through responsible disclosure. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did a leaked Konnectivity service token lead to RCE on a Kubernetes control plane? A worker node's Konnectivity token let an attacker reach port 8132 (AgentService), where a DIAL_REQ packet from the agent was wrongly treated as valid, creating an SSRF into the control plane. This reached the D-Bus UNIX socket, allowing a transient systemd user service to be started under UID 997, yielding a callback and code execution on the control plane node. Mirantis, maintainer of the k0s distribution, confirmed the vulnerability. _Teams hardening Kubernetes tunneling components can follow vulnerability writeups like this one on daily.dev._ ### What is CVE-2023-32629 and how does it enable privilege escalation on Ubuntu 22.04? CVE-2023-32629 is an OverlayFS kernel bug where, with user namespaces enabled, a file can retain cap_setuid+eip capabilities after namespace manipulation. On a target running Ubuntu 22.04 with kernel 5.15.x, this was exploited by creating a copy of the python3 interpreter with the setuid capability set, granting root privileges on the host. _Developers patching namespace-related kernel CVEs track disclosures like this on daily.dev._ ### What is CVE-2026-25243 in Valkey and what does it allow an attacker to do? CVE-2026-25243 is a heap overflow in Valkey's RESTORE command when handling legacy hash-zipmap encoded RDB objects: the validator accepts a 5-byte length for a short key, but the parser then misreads the key's bytes as the value-length encoding, causing an out-of-bounds write that can become an arbitrary write primitive. On an Ubuntu Noble build of Valkey 7.2.11, this was chained with a writable /tmp directory (noexec bypassed) to execute code and plant an SSH key for persistent access. _Engineers evaluating Valkey or Redis security patches can track CVE deep-dives like this on daily.dev._ ## Similar posts on daily.dev - [Understanding Current Threats to Kubernetes Environments](https://daily.dev/posts/understanding-current-threats-to-kubernetes-environments-fxdltzw1h) · Unit 42 · 1 upvotes · 0 comments - [OWASP Top 10 Kubernetes Security Risks Explained](https://daily.dev/posts/owasp-top-10-kubernetes-security-risks-explained-cp48vmlpq) · GitGuardian · 5 upvotes · 2 comments - [The Hidden Kernel Problem at the Heart of Cloud Native Security](https://daily.dev/posts/the-hidden-kernel-problem-at-the-heart-of-cloud-native-security-dzbrqdvdy) · The New Stack · 0 upvotes · 0 comments - [12 ways attackers abuse cloud services to hack your enterprise](https://daily.dev/posts/12-ways-attackers-abuse-cloud-services-to-hack-your-enterprise-rxvpwoj86) · CSO Online · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#kubernetes](https://daily.dev/tags/kubernetes) [View this post on daily.dev](https://daily.dev/posts/how-your-cloud-could-get-hacked-an-analysis-of-a-real-world-vulnerability-chain-fpulkynl5) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"How your cloud could get hacked: an analysis of a real-world vulnerability chain","url":"https://daily.dev/posts/how-your-cloud-could-get-hacked-an-analysis-of-a-real-world-vulnerability-chain-fpulkynl5","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/how-your-cloud-could-get-hacked-an-analysis-of-a-real-world-vulnerability-chain-fpulkynl5"},"datePublished":"2026-10-27T12:07:26.732Z","dateModified":"2026-10-27T12:08:16.731Z","description":"A Kaspersky pentest of a major cloud provider's managed Kubernetes service uncovered a chain of flaws that let an external tenant take over the entire cloud....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/710f7ffdd464abfa3eac9aa145b60f3a?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/710f7ffdd464abfa3eac9aa145b60f3a?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Securelist","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Securelist","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/e4b9f556af7a4e74a179787362dd5b07","url":"https://daily.dev/sources/securelist"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/how-your-cloud-could-get-hacked-an-analysis-of-a-real-world-vulnerability-chain-fpulkynl5","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,kubernetes","timeRequired":"PT16M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Securelist","item":"https://daily.dev/sources/securelist"},{"@type":"ListItem","position":3,"name":"How your cloud could get hacked: an analysis of a real-world vulnerability chain"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/how-your-cloud-could-get-hacked-an-analysis-of-a-real-world-vulnerability-chain-fpulkynl5#faq","mainEntity":[{"@type":"Question","name":"How did a leaked Konnectivity service token lead to RCE on a Kubernetes control plane?","acceptedAnswer":{"@type":"Answer","text":"A worker node's Konnectivity token let an attacker reach port 8132 (AgentService), where a DIAL_REQ packet from the agent was wrongly treated as valid, creating an SSRF into the control plane. This reached the D-Bus UNIX socket, allowing a transient systemd user service to be started under UID 997, yielding a callback and code execution on the control plane node. Mirantis, maintainer of the k0s distribution, confirmed the vulnerability. Teams hardening Kubernetes tunneling components can follow vulnerability writeups like this one on daily.dev."}},{"@type":"Question","name":"What is CVE-2023-32629 and how does it enable privilege escalation on Ubuntu 22.04?","acceptedAnswer":{"@type":"Answer","text":"CVE-2023-32629 is an OverlayFS kernel bug where, with user namespaces enabled, a file can retain cap_setuid+eip capabilities after namespace manipulation. On a target running Ubuntu 22.04 with kernel 5.15.x, this was exploited by creating a copy of the python3 interpreter with the setuid capability set, granting root privileges on the host. Developers patching namespace-related kernel CVEs track disclosures like this on daily.dev."}},{"@type":"Question","name":"What is CVE-2026-25243 in Valkey and what does it allow an attacker to do?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-25243 is a heap overflow in Valkey's RESTORE command when handling legacy hash-zipmap encoded RDB objects: the validator accepts a 5-byte length for a short key, but the parser then misreads the key's bytes as the value-length encoding, causing an out-of-bounds write that can become an arbitrary write primitive. On an Ubuntu Noble build of Valkey 7.2.11, this was chained with a writable /tmp directory (noexec bypassed) to execute code and plant an SSH key for persistent access. Engineers evaluating Valkey or Redis security patches can track CVE deep-dives like this on daily.dev."}}]} ```