Create a hostPath PersistentVolume mounting node / (or use an existing one via a PVC)
Claim the volume from an otherwise restricted-compliant pod.
PSA does not inspect the PV behind a PVC, so even the restricted profile does not block it
Read or write arbitrary node filesystem paths.
This is T0 on control plane nodes
Or set the PV's claimRef to a victim's PVC name and namespace, including one not yet created, so the victim's future workload silently binds to attacker-controlled storage
Rights needed, any one set:
· create the volume, claim it, mount it
· only where a hostPath PersistentVolume already exists
Note:
The base hostPath PV path is not version-patched, and Pod Security Admission does not block it at any profile.
PSA checks the pod's own volume types, never the PV behind a PVC.
runAsNonRoot only limits which host files are readable, not the mount.
CVE-2021-25741 is a separate, patched issue.