Exploit for CVE-2026-21008

## https://sploitus.com/exploit?id=4D029D8D-B806-5484-9CC8-ECC883920D2C
---

## CVE-2026-21008 – Kubernetes Service Account Token Mounted in HostPath

### Program Code (YAML + Python exploit)

```yaml
# vulnerable-pod.yaml - Pod that mounts /var/run/secrets/kubernetes.io/serviceaccount into a hostPath
apiVersion: v1
kind: Pod
metadata:
  name: sa-token-leak
spec:
  containers:
  - name: app
    image: nginx
    volumeMounts:
    - mountPath: /var/run/secrets/kubernetes.io/serviceaccount
      name: sa-token
  volumes:
  - name: sa-token
    hostPath:
      path: /var/run/secrets/kubernetes.io/serviceaccount  # Writable by container? Not needed.
      type: Directory

```

# CVE-2026-21008 – Kubernetes SA Token Leak via hostPath Mount

![Severity: High](https://img.shields.io/badge/severity-high-orange)

## Overview
A pod mounts the Kubernetes service account token directory via `hostPath` instead of the default projected volume. This exposes the token to other pods on the same node if they can read the host filesystem, allowing lateral movement and cluster compromise.

## Vulnerability Details
- **Type:** Information Disclosure / Privilege Escalation
- **Impact:** Cluster admin access via stolen SA token.
- **Root Cause:** Using `hostPath` to mount the SA token directory bypasses the in‑memory token projection and makes the token a persistent file on the node.

## Exploit Demonstration
Deploy the vulnerable pod, then from another pod with host access, run:
```bash
python exploit_sa_token.py
```

The token is read and can be used to authenticate to the API server.