How One Kubernetes YAML Can Hand Over a GCP Organization

A security research by Varonis reveals a confused deputy attack vector where a Kubernetes user with limited permissions can escalate privileges to gain control of an entire Google Cloud (GCP) organization. The attack exploits the elevated authority granted to Google Kubernetes Config Connector, a component that bridges Kubernetes and GCP resources. By crafting a single malicious Kubernetes YAML file, an attacker can abuse the Config Connector's permissions to perform organization-wide privilege escalation. The vulnerability represents a significant misconfiguration and design risk in hybrid Kubernetes-GCP environments. Organizations using GCP with Kubernetes Config Connector should review and restrict the permissions granted to this component to minimize blast radius.