Escaping a hardened container via a leaky CNI plugin

The trust boundary

Kubernetes annotations are ordinary tenant-controlled input. A CNI plugin runs with node-level privileges. When the second trusts the first without validation, the tenant boundary is gone.

What went wrong

The plugin used an annotation value while configuring pod networking. The value reached a privileged code path unchecked, which exposed node credentials to a workload that should never see them.

Hardening checklist

Validate every annotation a privileged component reads. Scope kubelet credentials tightly, restrict node access with admission policy, and alert when a workload touches node-level paths.