Admission policy bypass via mutated old Node state

Authorization bypass in Kubernetes kube-apiserver allows remote authenticated users to evade Node update admission policy. ValidateNodeUpdate mutates the old Node object while comparing permitted field changes; the altered object is then sent as oldObject to validating admission webhooks, hiding original values. Exploitation requires high-privilege Node update rights and a webhook that denies updates based on those old values; successful bypass permits unauthorized cluster changes.