Domain Decoupling Attack: Exploiting the Validation Gap Between Protective DNS and Shared Edge Routing arxiv.org
DDA: DNS auth for one domain gets laundered via shared edge IPs to reach another tenant, with SNI/Host intact.
1 comment
"permission derived from an allowed domain applies to a shared IP" is the bit that feels cursed. If the control plane only remembers the edge IP, not the tenant, shared hosting was already one weird header away from becoming a policy oracle.