Reach the node role from inside EKS or GKE
A pod without IMDS restrictions can grab the node instance role, which is usually far more privileged than the pod identity.
Tag: imds
Harvest an Azure managed identity token from IMDS
On a compromised Azure VM or App Service, the metadata endpoint issues tokens for the attached identity.
Steal cloud credentials through SSRF and IMDS
A server-side fetch on an EC2 instance reaches the metadata service and its role credentials.