Exploit for CVE-2026-5556

## https://sploitus.com/exploit?id=A285DFCD-7F5B-5E98-90BC-06238C2D119E
---

## CVE-2026-5556 – Kubernetes Admission Controller Bypass via Case Sensitivity

### **Program Code (Python admission webhook + exploit)**

```python
#!/usr/bin/env python3
# admission_webhook.py - Vulnerable webhook that rejects pods with specific name
from flask import Flask, request, jsonify

app = Flask(__name__)

DENIED_POD_NAMES = ["kube-system-svc", "admin-pod"]

@app.route('/validate', methods=['POST'])
def validate():
    req = request.get_json()
    pod_name = req["request"]["object"]["metadata"]["name"]
    # Flaw: case‑sensitive comparison
    if pod_name in DENIED_POD_NAMES:
        return jsonify({"response": {"allowed": False, "status": {"message": "Name denied"}}})
    return jsonify({"response": {"allowed": True}})

if __name__ == '__main__':
    app.run(port=443, ssl_context='adhoc')  # using self-signed cert for demo

```

# CVE-2026-5556 – Kubernetes Admission Controller Case‑Sensitivity Bypass

![Severity: High](https://img.shields.io/badge/severity-high-orange)

## Overview
An admission webhook that validates pod names uses case‑sensitive string matching against a deny‑list. An attacker can bypass the restriction by changing the case of the pod name, because Kubernetes treats names as case‑preserving but often performs case‑insensitive lookups, leading to unauthorized pod creation.

## Vulnerability Details
- **Type:** Access Control Bypass
- **Impact:** Deployment of privileged or restricted pods, potential cluster compromise.
- **Root Cause:** The webhook compares the pod name exactly, but the Kubernetes API may accept the same name with different case, and other components treat it as equivalent.

## Exploit Demonstration
1. Start the admission webhook:
   ```bash
   python admission_webhook.py
2. Send a pod creation request with a case‑changed name:
   ```bash
   python exploit_admission_bypass.py