Description
OpsTree BuildPiper before 2.7.0 contains an improper authorization vulnerability that allows authenticated deploy users to define arbitrary Kubernetes hostPath volumes without allow-list or policy checks. Attackers can set the host path to / in the Define HostPath Volume configuration to mount the worker node root filesystem read-write, breaking container isolation and enabling node and cluster compromise.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpsTree Solutions | BuildPiper | < 2.7.0 | 2.7.0 |
References
- https://gist.github.com/neelkotnis/b8c1cf47f829c28086fe78d8187eb938 technical-description exploit
- BuildPiper Product Page product
- VulnCheck Advisory: OpsTree BuildPiper before 2.7.0 Container Escape via Unrestricted HostPath Volumes third-party-advisory