The insights-runtime-extractor DaemonSet runs with privileged host PID access and scans container processes for runtime fingerprinting. It forks a child process, enters the target container's namespaces, and executes a binary controlled by the container workload with elevated privileges. Due to insufficient privilege dropping (only effective UID is changed, real and saved UIDs remain 0) and execution of a workload-controlled binary path, an attacker able to schedule a pod can execute arbitrary code as root on the host node, leading to full node compromise.