OpenStack

GitLab Developer Account Leads to Full OpenStack Cloud Control via CI/CD Runner Misconfigurations

A penetration testing team demonstrated how a standard developer account in GitLab can be escalated to full administrative control over an OpenStack cloud environment through typical CI/CD misconfigurations. Starting with only GitLab credentials, the testers created a pipeline that executed arbitrary commands on a production Kubernetes runner named PROD-K8S-RUNNER01. Membership in the docker group allowed privilege escalation to root by mounting the host filesystem and adding an SSH key. From the compromised host, the team discovered a kubeconfig file granting extensive Kubernetes permissions including secret access, pod execution, and role bindings. This access enabled mounting a node filesystem to extract OpenStack cloud-config credentials. The resulting cloud account possessed broad roles across nova, cinder, neutron, and other services, effectively providing administrator-level control over virtual machines, networks, storage, and managed Kubernetes clusters.