#ConfigConfusion
LightNews LightNews
hendryadrian.bsky.social
One Kubernetes YAML can abuse Config Connector when org-level IAM is too broad, letting a low-privilege K8s user escalate to Google Cloud org control through the ConfigConfusion confused deputy flaw. #ConfigConnector #KCC #ConfigConfusion
How One Kubernetes YAML Can Hand Over A GCP Organization
Config Connector (KCC) removes the need for developers to handle Google Cloud credentials by letting Kubernetes controllers manage resources on their behalf through GitOps. But if KCC has broad organization-level IAM permissions, a user with limited Kubernetes access can exploit the confused deputy flaw in ConfigConfusion to gain Google Cloud control. #ConfigConnector #KCC #ConfigConfusion #WorkloadIdentity #GoogleKubernetesEngine
www.hendryadrian.com
October 2, 2026 at 4:30 AM
deafnews-auto.bsky.social
ConfigConfusion: One YAML File to Become Organization Owner in GCP
ConfigConfusion: One YAML File to Become Organization Owner in GCP
ConfigConfusion exploits Google Kubernetes Config Connector to escalate from a namespace user to Organization Owner without GCP credentials. Google initially accepted the report as P1/S1, then reversed course, classifying it as "working as intended" and declining to issue a patch.
deafnews.it
September 24, 2026 at 7:12 AM
threadlinqs.bsky.social
A single Kubernetes YAML can hand an attacker full GCP org ownership. Google's verdict: working as designed. https://intel.threadlinqs.com/threat/TL-2026-2629 #ThreatIntel #ConfigConfusion #GCP #Kubernetes
ConfigConfusion: Missing Authorization Check in GCP Config Connector Lets a Kubernetes Namespace User Seize Organization Owner
September 23, 2026 at 2:40 PM
kubernetes.activitypub.awakari.com.ap.brid.gy
Great, Now Google Is Getting Miserly On Bug Bounties Google seems to have learned nothing from what is currently happening to users of Microsoft Windows. A security researcher discovered a way fo...

#General #Tech #alphabet #ConfigConfusion #Google #Security

Origin | Interest | Match
Great, Now Google Is Getting Miserly On Bug Bounties
pcper.com
June 19, 2026 at 9:18 PM
mrsyiswhy.bsky.social
olearysec.com/research/con...
ConfigConfusion: GCP IAM Authorization Bypass — Google Said 'Nice Catch' Then Left It Unpatched
GCP IAM authorization bypass via Config Connector confused deputy allows any Kubernetes user to escalate to GCP Organization Owner, bypassing all IAM controls. CVSS 10.0. Google's VRP acknowledged it,...
olearysec.com
June 19, 2026 at 9:22 PM