Justin O’Leary
Principal Engineer & Security Researcher
Philadelphia, New York, United States
Actions
Justin O'Leary is an independent security researcher at olearysec.com. He hunts confused deputy flaws in cloud-native infrastructure, the places where a Kubernetes operator trusts a namespace more than it should. That work has produced privilege escalation findings in Config Connector, AWS Controllers for Kubernetes, Azure Service Operator and Crossplane, a Black Hat USA 2026 briefing, and a GCVE Numbering Authority designation (GNA-119). He has also spent twenty years as the operator on the other side of those trust boundaries, most recently running research infrastructure at Children's Hospital of Philadelphia.
Links
Area of Expertise
The Operator Calls Are Coming from Inside the Namespace
You locked down RBAC. You scoped your namespaces. You followed least privilege. But the attacker who just became your GCP Org admin? They never left their namespace. The call came from inside the cluster—through your own operator.
I discovered confused deputy vulnerabilities (CWE-441) across Config Connector, ACK, ASO, and Crossplane. The pattern is universal: operators trust user-controlled CRD fields and act with elevated credentials. Your namespace user writes a manifest; the controller escalates them to cloud admin.
You'll see:
- Demo: namespace user → GCP Org admin in 60 seconds
- Why audit logs blame the controller, not the attacker
- A 3-step pattern to audit any operator for confused deputy flaws
- Architectural fixes you can deploy immediately
This research is also accepted at Black Hat USA 2026. This talk is Kubernetes-native: how operator architecture enables this flaw class and how to build controllers that fail closed.
KubeCon + CloudNativeCon North America 2026 Sessionize Event Upcoming
Justin O’Leary
Principal Engineer & Security Researcher
Philadelphia, New York, United States
Links
Actions
Please note that Sessionize is not responsible for the accuracy or validity of the data provided by speakers. If you suspect this profile to be fake or spam, please let us know.
Jump to top