How One Kubernetes YAML Can Hand Over a GCP Organization
BLUF
Limited Kubernetes users can escalate privileges to own your entire GCP organization via Config Connector misconfigurations.
NEWS
Security researchers at Varonis identified a confused deputy vulnerability in Google Kubernetes Config Connector that enables privilege escalation. Attackers with minimal cluster permissions can submit a malicious YAML file to gain organization-wide control over Google Cloud resources. This issue was highlighted in a recent report detailing the attack vector and potential scope.
Why I Care
The stakes are critical as this compromises the entire cloud infrastructure, not just a single pod or namespace. Any organization running GKE with Config Connector enabled is at risk of total account takeover and data exfiltration. Cloud security teams and DevOps engineers managing Kubernetes clusters must prioritize this immediately.
Next Steps
Audit all Kubernetes manifests for excessive permissions granted to Config Connector resources immediately. Restrict service account scopes and implement least privilege principles for cluster users within the next 7 days. Review GCP IAM policies to ensure separation between Kubernetes roles and cloud organization management.
Source: BleepingComputer ·