GoKawiilSecurity researchers detail GCP privilege-escalation risk in Kubernetes Config Connector
Researchers describe how Google Kubernetes Config Connector (KCC), a GitOps controller used to manage Google Cloud resources from Kubernetes YAML files, can be manipulated through resources like IAMPolicyMember to escalate privileges. Because KCC authenticates to Google Cloud on behalf of developers using its own credentials, a maliciously crafted or overly permissive YAML file applied to a cluster could grant broad access across a Google Cloud organization.
GoKawiil's interpretation of the reporting above, not reported fact.
KCC was designed to eliminate the 'secret sprawl' problem of scattered service account keys by removing direct developer credentials, but this analysis suggests that consolidating authority into a single controller identity can create a new single point of failure. If an attacker or careless configuration gains the ability to apply YAML to the cluster, they could potentially inherit the controller's elevated permissions across an entire Google Cloud organization, meaning teams using GitOps for cloud infrastructure may need stricter controls over who can commit or apply configuration files.
- Google Kubernetes Config Connector (KCC) lets developers manage GCP resources via YAML instead of holding service account keys directly.
- The GitOps model shifts credential risk from scattered individual keys to a single, highly privileged controller identity.
- Misconfigured or malicious YAML applied through KCC, such as IAMPolicyMember resources, could potentially be used to escalate privileges within a GCP organization.
Source: bleepingcomputer.com — Two Authorization Systems, 2026-09-23
Published there as: “How One Kubernetes YAML Can Hand Over a GCP Organization”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.