Compromise a scheduler component, built-in or custom, whose ServiceAccount holds create on pods/binding but not pods itself, matching the real system:kube-scheduler role

RBAC cannot filter by a Pod's schedulerName field, so any Pod already Pending in the cluster is fair game, not only ones addressed to that scheduler

Create a Binding object for a target Pod naming the desired Node directly, skipping the scheduler's own logic entirely

The kubelet does not re-check taints at admission, so the Pod runs even on a NoSchedule-tainted node with no matching toleration

Admission policy engines typically register their webhook on pods CREATE/UPDATE only.

Binding is a different subresource they never inspect, so node-placement policies never see it

Targeting a control plane node places a workload past the taint meant to keep it off.

Combined with a privileged/hostPath Pod spec, this reaches node compromise