george0papasotiriou/cve-2026-5556-kubernetes-admission-controller-bypass-via-case-sensitivityExploit PoC and vulnerable admission webhook for CVE-2026-5556, demonstrating Kubernetes admission controller bypass via case-sensitive pod name comparison that allows unauthorized pod creation.
#!/usr/bin/env python3
# admission_webhook.py - Vulnerable webhook that rejects pods with specific name
from flask import Flask, request, jsonify
app = Flask(__name__)
DENIED_POD_NAMES = ["kube-system-svc", "admin-pod"]
@app.route('/validate', methods=['POST'])
def validate():
req = request.get_json()
pod_name = req["request"]["object"]["metadata"]["name"]
# Flaw: case‑sensitive comparison
if pod_name in DENIED_POD_NAMES:
return jsonify({"response": {"allowed": False, "status": {"message": "Name denied"}}})
return jsonify({"response": {"allowed": True}})
if __name__ == '__main__':
app.run(port=443, ssl_context='adhoc') # using self-signed cert for demo
An admission webhook that validates pod names uses case‑sensitive string matching against a deny‑list. An attacker can bypass the restriction by changing the case of the pod name, because Kubernetes treats names as case‑preserving but often performs case‑insensitive lookups, leading to unauthorized pod creation.
python admission_webhook.py
python exploit_admission_bypass.py