How We Uncovered a Full Chain Exploit During a Client Pentest

In today’s cloud-driven world, companies are moving quicker than ever and deploying software across complex systems to serve users at scale. Tools like Kubernetes and GitOps platforms (such as ArgoCD, Helm, and GoCD) help automate and streamline these operations. But with this speed and efficiency comes a hidden risk: security misconfigurations that can quietly open the door to attackers.

This blog post is the first in a series that explores the findings from a real-world security audit we conducted for a client. Throughout the series, we demonstrate how an attacker, with limited access, could traverse a cloud-native deployment pipeline, from Kubernetes to GitOps tools, ultimately gaining control over critical infrastructure and sensitive data.

Understanding the Security Stakes in Modern DevOps

Today’s DevOps environments rely heavily on a combination of Kubernetes for orchestration and GitOps tools to manage deployments and configurations. These tools are incredibly powerful and enable teams to release features quickly, automate rollouts, and recover from failure with ease.

However, they also introduce new risks:

• A single misconfiguration can lead to privilege escalation.
• Over-permissioned tokens can grant unintended access to cloud resources.
• Reused passwords across services can provide easy footholds for lateral movement.

GitOps tools like ArgoCD, Helm, and GoCD often interact directly with cloud APIs, source control systems, and Kubernetes clusters. When these tools are not hardened properly, they become high-value targets for attackers.

Real-World Exploitation: An Attack Chain Walkthrough

Initial Access via Kubernetes RBAC

Our investigation began with limited credentials inside a Kubernetes cluster. The user had an “Edit” role within a single namespace. While this may seem low risk, it allowed us to deploy a pod with elevated privileges.

Using this pod, we performed a namespace escape, granting us visibility into other namespaces, secrets, and workloads within the cluster. This highlights a common oversight: granting overly permissive roles in Kubernetes environments.

Find out in part two of this series how we leveraged a seemingly benign Kubernetes RBAC role to escalate privileges and compromise the broader cluster.

ArgoCD Exploitation and Lateral Movement

From our now elevated position, we discovered ArgoCD running in the environment. Due to insufficient secret management practices, we were able to extract the ArgoCD admin password from a mounted configuration file within one of the containers.

Once authenticated, we used ArgoCD’s repo-server configuration to access AWS tokens embedded in deployment manifests. These tokens had full permissions to manage EC2 instances which shows a critical lapse in least-privilege principles.

Read about the details of how we exploited ArgoCD misconfigurations to access cloud infrastructure and pivot deeper into the environment in part three of our series.

GoCD Misconfiguration and Sensitive Token Leak

The investigation continued as we tested access to GoCD. The reused admin credentials from ArgoCD worked here as well indicating poor password hygiene.

While logged in as a pipeline operator, we discovered an argument injection vulnerability in one of the pipeline definitions. This allowed us to run arbitrary commands on the underlying agents. We used this flaw to extract a GitHub token from an environment variable, which granted read/write access to sensitive private repositories.

Learn more about how we exploited GoCD to execute arbitrary commands and exfiltrate sensitive developer credentials in the final part of our series.

Why DevOps Needs Built-In Kubernetes Protection

This chain of exploits demonstrates how minor oversights can escalate into full infrastructure compromise. Starting with limited Kubernetes access, an attacker can:

• Escalate privileges via pod misconfigurations
• Move laterally across tools like ArgoCD and GoCD
• Exfiltrate cloud provider credentials and source code

This type of attack is particularly dangerous in environments that combine continuous delivery with cloud-native infrastructure. When secrets, permissions, and credentials are not tightly controlled, they create an interconnected web of risk.

This is why security must be embedded throughout the entire DevOps lifecycle. That means reviewing configurations, enforcing least privilege, and treating every tool in your stack as a potential entry point.

To get there, organizations should combine offensive and defensive approaches. Regular penetration testing helps uncover vulnerabilities from an attacker’s perspective, while secure by design principles ensure that systems are built with strong safeguards from the ground up. Together, they create a feedback loop that reduces risk and hardens your environment over time.

Closing the Gaps in Kubernetes Security

Kubernetes and GitOps tools can offer tremendous power and agility, but they also create new attack surfaces that traditional security teams may overlook. This investigation highlights how attackers can chain together small vulnerabilities to gain significant control over cloud infrastructure.

By learning from real-world scenarios like this one, organizations can proactively close gaps before they’re exploited.