Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Google Kubernetes Config Connector KCC confused deputy authorization security flaw

Vulnerability
First reported
Last updated
Happening score
H score 33
1 unique sources, 1 articles

Summary

Hide ▲

Google Kubernetes Config Connector (KCC) has a confused deputy authorization flaw that can let users with only Kubernetes namespace access trigger Google Cloud IAM changes through KCC's service account. In vulnerable deployments, that can turn limited cluster permissions into organization-level Google Cloud control without any Google Cloud credentials. The issue sits at the boundary between Kubernetes RBAC and Google Cloud IAM, where KCC fails to verify that the requesting user should be allowed to use its authority.

Related Happenings

OwnCloud WebDAV API authentication bypass (CVE-2023-49105, actively exploited)

Vulnerability
H score43 First: 28.08.2026 18:56 Last: 28.08.2026 18:56 Sources 1

About this happening: CVE-2023-49105 was added to CISA's KEV catalog after active weaponization against ownCloud instances, exposing affected systems to unauthorized file access. The fl...

Open Happening

Google Cloud ships quantum-safe key exchange and publishes post-quantum migration roadmap

Security Tool/Service
H score11 First: 13.08.2026 18:00 Last: 13.08.2026 18:00 Sources 1

About this happening: Google Cloud has begun rolling out quantum-safe key exchange and a staged post-quantum migration roadmap, expanding cryptographic protections for cloud services ahead...

Open Happening

Google ADK Python repository workflow prompt-injection security flaw

Vulnerability
H score34 First: 04.08.2026 14:16 Last: 04.08.2026 14:16 Sources 1

About this happening: Google's ADK Python repository workflows had a prompt-injection flaw that let a public GitHub issue steer a trusted triage bot into a privileged code-fixing path. Rese...

Open Happening

Pass-ta-key attacks against Google Password Manager on Windows TPM devices

Technical Analysis
H score23 First: 04.08.2026 02:58 Last: 04.08.2026 02:58 Sources 1

About this happening: Pass-ta-key is a technical analysis of three attacks against Google Password Manager synced passkeys in Chrome on Windows devices with TPM. Palo Alto Networks Un...

Open Happening

Chrome Google Password Manager passkey post-compromise techniques on Windows

Technical Analysis
H score3 First: 03.08.2026 19:24 Last: 03.08.2026 19:24 Sources 1

About this happening: Unit 42 expanded the Chrome Google Password Manager passkey happening with Pass-ta-key research that shows how malware already on a Windows endpoint can manipulate...

Open Happening

Timeline

  1. 23.09.2026 17:01 2 articles · 3h ago

    ConfigConfusion exposes KCC organization-level privilege escalation

    Initial Disclosure

    Security researcher Justin O'Leary identified ConfigConfusion in Google Kubernetes Config Connector (KCC), where a user with Kubernetes namespace access and permission to create IAMPolicyMember resources can use KCC's organization-level Google Cloud authority to grant privileges such as roles/owner on a Google Cloud organization. KCC performs Google Cloud operations through its own service account, so Google Cloud evaluates the request as coming from KCC rather than the Kubernetes user who triggered it.

    Show sources
    Open in new tab