One Kubernetes YAML can abuse Config Connector when org-level IAM is too broad, letting a low-privilege K8s user escalate to Google Cloud org control through the ConfigConfusion confused deputy flaw. #ConfigConnector #KCC #ConfigConfusion
How One Kubernetes YAML Can Hand Over A GCP Organization
Config Connector (KCC) removes the need for developers to handle Google Cloud credentials by letting Kubernetes controllers manage resources on their behalf through GitOps. But if KCC has broad organization-level IAM permissions, a user with limited Kubernetes access can exploit the confused deputy flaw in ConfigConfusion to gain Google Cloud control. #ConfigConnector #KCC #ConfigConfusion #WorkloadIdentity #GoogleKubernetesEngine
www.hendryadrian.com
October 2, 2026 at 4:30 AM
One Kubernetes YAML can abuse Config Connector when org-level IAM is too broad, letting a low-privilege K8s user escalate to Google Cloud org control through the ConfigConfusion confused deputy flaw. #ConfigConnector #KCC #ConfigConfusion
TagsTagBinding, and VertexAIIndex resources. Updated status.observedGeneration in ConfigConnector object.
November 17, 2025 at 11:33 AM
TagsTagBinding, and VertexAIIndex resources. Updated status.observedGeneration in ConfigConnector object.