针对 CVE-2026-5556 的漏洞利用 PoC 和存在漏洞的准入 Webhook，演示了通过区分大小写的 Pod 名称比较实现 Kubernetes 准入控制器绕过，从而允许未授权的 Pod 创建。
" or "use". The actual input as provided might have an unclosed code fence. Our translation should preserve the exact given markdown, including the unclosed code fence? But the user expects valid Markdown maybe. We need not correct. Let's examine the initial code block: It has an opening python and a closing after app.run. That's fine. The second code fence starts with ```bash, and then the line python exploit_admission_bypass.py. There is no closing fence. So the output likely should be as-is, unclosed. But if we output unclosed code fence, the rest of the response? No rest. The code block runs to end. That's okay. However, in a Markdown renderer, an unclosed code block will treat the rest as code, but since end of document, fine. But is it acceptable? The instruction "Preserve ALL Markdown structure intact" indicates yes.
Need also translate the Python comments? Rule says translate only natural language text. Code comments are natural language within code. Should we translate comments inside code? The rules say "NEVER translate: code blocks" and "Translate ONLY natural language text." Code blocks are code, including comments? If we translate code comments, we change code behavior? Comments don't affect behavior but they are within code. The instruction says code blocks must be preserved exactly. "Preserve ALL Markdown structure exactly" and "NEVER translate: code blocks, shell commands..." So translate no code block content, including comments. The Python code block remains unchanged. The bash code line remains unchanged. The comment "# Flaw: case‑sensitive comparison" inside code stays English. Good.
Need preserve "Python admission webhook + exploit" heading? It's outside code, natural text. Translate heading.
Need translate "Program Code" maybe "程序代码". Keep "(Python admission webhook + exploit)" maybe "（Python 准入 Webhook + 漏洞利用）".
Need be careful with non-breaking hyphens: Source uses "case‑sensitive" with a non-breaking hyphen U+2011? We can translate to Chinese "区分大小写". In code comment, preserve exactly "case‑sensitive" as in code. In natural text, use Chinese.
Need perhaps use "deny-list" vs "黑名单" or "拒绝列表". "deny-list" -> "拒绝列表" or "黑名单". Use "拒绝名单" maybe. In Chinese security context, "黑名单" is common. But "deny-list" is a term. We can translate as "黑名单（deny-list）"? To avoid over-translating, use "拒绝列表". Let's settle.
Need maybe "Case Sensitivity" in title: "大小写敏感性" or "大小写敏感". Let's produce natural Chinese.
Let's craft full translation:
#!/usr/bin/env python3
# admission_webhook.py - Vulnerable webhook that rejects pods with specific name
from flask import Flask, request, jsonify
app = Flask(__name__)
DENIED_POD_NAMES = ["kube-system-svc", "admin-pod"]
@app.route('/validate', methods=['POST'])
def validate():
req = request.get_json()
pod_name = req["request"]["object"]["metadata"]["name"]
# Flaw: case‑sensitive comparison
if pod_name in DENIED_POD_NAMES:
return jsonify({"response": {"allowed": False, "status": {"message": "Name denied"}}})
return jsonify({"response": {"allowed": True}})
if __name__ == '__main__':
app.run(port=443, ssl_context='adhoc') # using self-signed cert for demo
一个用于校验 Pod 名称的准入 Webhook 使用区分大小写的字符串匹配来对照拒绝列表。攻击者可以通过更改 Pod 名称的大小写来绕过该限制，因为 Kubernetes 会保留名称的大小写，但在很多情况下会执行不区分大小写的查找，从而导致未授权的 Pod 被创建。
python admission_webhook.py
python exploit_admission_bypass.py
Need ensure the final code fence remains unclosed? I think yes, but is that safe? It mirrors input. However, the output will have an unclosed code block. That is expected? But if we need to produce valid Markdown, maybe we should add a closing fence. Yet instruction: preserve. Let's inspect whether there is a hidden issue: In the original prompt, the "INPUT" ends with python exploit_admission_bypass.py followed by a newline, and then likely the closing triple backticks of the prompt's code block? Wait, the entire "INPUT:" is in the system prompt, not necessarily code-fenced. The user's message content has Markdown text. The content ends with:
```bash
python exploit_admission_bypass.py
No closing. That is part of the content. A Markdown parser would treat the rest of document (nothing) as code. So output exactly same structure is fine.
But the first code fence after "### Program Code" has a blank line after closing triple? Source:
app.run(port=443, ssl_context='adhoc') # using self-signed cert for demo
Then a line with triple backticks and blank line. Yes.
Need not include content after the last code fence. We'll end with the unclosed fence? Wait, if we output an unclosed code fence, then the response ends with code fence? Actually the last line is the bash command, no closing. So output ends there. That's okay.
But wait, the response might be expected to be raw Markdown. If the final code fence is unclosed, some renderers may interpret all preceding from the opening as code, but since it's at end, no visible issue. Still, preserve.
Need verify "CVE-2026-5556 – Kubernetes Admission Controller Bypass via Case Sensitivity" translation. Maybe "通过大小写敏感性绕过 Kubernetes 准入控制器" is a bit off. Better: "CVE-2026-5556 – Kubernetes 准入控制器大小写敏感性绕过" as the second title. The first title specifically: "Kubernetes Admission Controller Bypass via Case Sensitivity" -> "借助大小写敏感性绕过 Kubernetes 准入控制器" or "通过大小写敏感性实现 Kubernetes 准入控制器绕过". The second title "Kubernetes Admission Controller Case‑Sensitivity Bypass" -> "Kubernetes 准入控制器大小写敏感性绕过". These are slightly different. Need translate both accordingly.
Let's craft first: "## CVE-2026-5556 – 通过大小写敏感性绕过 Kubernetes 准入控制器" Second: "# CVE-2026-5556 – Kubernetes 准入控制器大小写敏感性绕过"
Need maybe "Admission Controller" -> "准入控制器". "Webhook" maybe "Webhook" stays. In Chinese "webhook" often not translated. Use "Webhook".
Need "Pod" in Kubernetes stays as "Pod". Good.
Need "cluster compromise" -> "集群沦陷" or "集群遭受入侵". Use "导致集群被入侵" to be clear.
Need "Root Cause" -> "根本原因" or "根因". Use "根本原因".
Need "case‑preserving" -> "保留大小写" or "保留原有大小写". Use "保留名称的大小写".
Need "case‑insensitive lookups" -> "不区分大小写的查找" or "进行不区分大小写的查询". Use "查找".
Need "unauthorized pod creation" -> "未授权的 Pod 创建" or "导致未经授权即可创建 Pod". Use "从而导致可创建未授权的 Pod". Let's craft a more natural sentence: "攻击者可以通过更改 Pod 名称的大小写来绕过该限制，因为 Kubernetes 会保留名称的大小写，但在很多情况下会执行不区分大小写的查找，从而允许创建未授权的 Pod。"
Need "deny-list" maybe "拒绝列表". Good.
Need preserve non-breaking hyphens in English words outside code? In translations, no need. But inside code, keep exactly. The code's comments have "case‑sensitive" with non-breaking hyphen? We must keep code block verbatim. Our output should include the original lines exactly, including non-breaking hyphen? If we copy the user's code block, yes. We'll include the exact code block content. Should not accidentally normalize hyphen. We can copy from the source. The source is plain in the prompt, but we can reproduce. Need ensure no translation of comments.
Need perhaps not translate "Program Code" heading? It's natural. "Program Code (Python admission webhook + exploit)" -> "程序代码（Python 准入 Webhook 与漏洞利用）". Use "与" or "和". Good.
Need think about the final Bash code line "python exploit_admission_bypass.py" - no output? Keep.
Need ensure no Chinese punctuation in code. None.
Need also maybe translate "Overview" as "概述", "Vulnerability Details" as "漏洞详情". "Exploit Demonstration" as "漏洞利用演示".
Need maybe "Access Control Bypass" -> "访问控制绕过" but "Type" field maybe "类型". Good.