We continue to publish details of our talks at the SAS 2026 conference. As we already mentioned in the announcement, Matvey Bukhtoyarov’s presentation was based on the results of a project assessing the security of a major cloud provider.
The pentest followed the threat model of an external attacker with the privileges of a regular tenant. By exploiting several vulnerabilities and logical flaws, our experts successfully byppassed the tenant isolation within the cloud and gained access to customers’ message brokers (Kafka, Postgres, Redis). We also managed to leverage an SQL injection in SaltStack to access the cloud’s main metabase.
Based on the pentest results, the client was recommended necessary security measures, including isolation of managed services to eliminate network visibility between them, enforcement of strict AppArmor policies to isolate service processes, and monitoring the usage of potentially vulnerable services. The client promptly fixed all the vulnerabilities we reported.
Details of this research are available in the article "An insecure neighbor: how a vulnerability chain led to an isolation bypass in cloud infrastructure".
