local-path-provisioner: helper pod template injection yields a privileged pod with host root mounted

Impact

local-path-provisioner is a common way to hand node-local NVMe or scratch space to pods on GPU nodes. Anyone able to edit the local-path-config ConfigMap in the local-path-storage namespace can plant securityContext.privileged, hostPath volumes and extra Linux capabilities into the helperPod.yaml template, which the provisioner then instantiates verbatim on the next PVC provision or cleanup. The result is a privileged pod with the host root filesystem mounted on the target node: host file read/write, ServiceAccount tokens belonging to other pods scheduled there, and the local-path volume data of other tenants. On a GPU node that is the whole node, including whatever training data and credentials the co-tenant workloads hold.

Who can reach it

Authenticated Kubernetes user or service account with edit rights on the local-path-config ConfigMap in the local-path-storage namespace. No node access needed - the provisioner does the privileged creation on the attacker's behalf.

What to do

Upgrade local-path-provisioner to 0.0.36 and restart the provisioner deployment; no node drain or reboot is needed. Until then, tighten RBAC so no workload identity can write that ConfigMap and audit it for injected securityContext or hostPath entries.

References

Related entries

• Argo CD: application annotations render as unvalidated hrefs, allowing javascript: execution in an admin sessionCVE-2026-45738 · Argo CD UI (application-summary link.argocd.argoproj.io annotation rendering)High
• NGINX Ingress Controller: unsanitized CRD and annotation fields inject arbitrary NGINX directivesCVE-2026-55723 · NGINX Ingress Controller (configuration generator, CRDs and Ingress annotations)High
• Docker MCP Gateway: OCI image label controls run arguments, allowing host mounts and UID 0CVE-2026-55887 · Docker MCP Gateway (io.docker.server.metadata OCI label -> docker run arguments)High
• Firecracker: Out-of-bounds write in the virtio PCI transportCVE-2026-5747 · FirecrackerHigh
• Red Hat ACM lighthouse: unvalidated EndpointSlice IPs let a spoke cluster hijack cross-cluster service trafficCVE-2026-66787 · Red Hat Advanced Cluster Management lighthouse (cross-cluster service DNS)High
• Dockge: authenticated user reads or deletes arbitrary host directories via stack-name traversalCVE-2026-73040 · Dockge (Docker Compose stack manager, stack-name path traversal)High