Argo Events (EventSource / Sensor controller, spec.template.container merge): The controller merges the entire

Impact

The controller merges the entire user-supplied container spec from an EventSource or Sensor custom resource into the pod it creates, so a tenant who can only create those CRs sets securityContext.privileged, adds SYS_ADMIN, and hostPath-mounts the node root. That is node compromise and, through the container runtime socket, cluster compromise - from a namespace-scoped permission that looks harmless. Argo Events is the trigger layer in front of Argo Workflows, so this sits on the same GPU job-submission path.

Who can reach it

Any tenant with create or update rights on EventSource or Sensor CRs in any namespace the controller watches. No cluster-admin, no node access, no direct pod-create permission needed - Pod Security Standards and namespace RBAC are both bypassed.

What to do

Upgrade Argo Events to v1.9.6, which allow-lists which properties under spec.template.container may be set. Restart the controller. Before and after, audit existing EventSource and Sensor objects for privileged securityContext or hostPath volumes - a resource planted earlier keeps running until you delete it.

References