#BrokenSesame: Accidental ‘write’ permissions to private registry allowed potential RCE to Alibaba Cloud Database Services

Wiz Research disclosed “#BrokenSesame,” a chain of critical flaws in Alibaba Cloud’s managed PostgreSQL services that allowed privilege escalation inside containers, escape to the Kubernetes node, access to other tenants’ pods and data, and write access to the private container registry enabling a potential supply‑chain remote code execution. The blog details attack paths, root causes (namespace sharing, over‑privileged kubelet, non‑scoped registry credentials, secret leakage), and remediation steps taken by Alibaba Cloud after responsible disclosure.