Cloud Credentials in Jeopardy: How a Single Kubernetes YAML Can Grant Access to an Entire GCP Organization
A recent security vulnerability has been discovered in the way Google’s Kubernetes Config Connector (KCC) manages cloud credentials for developers. In a surprising twist, it appears that an attacker with limited access to a Kubernetes namespace can escalate their privileges and gain control over an entire organization’s resources using nothing more than a single YAML file.
For those who may not be familiar, KCC is a tool used by Google Cloud to manage infrastructure as code (IaC) through Kubernetes. It allows developers to declare the resources they need in a Git repository, which are then automatically created and updated by the controller running inside the cluster. This approach has been hailed as a solution to the problem of “secret sprawl” – the tendency for cloud credentials to be scattered across machines, pipelines, and codebases, making them difficult to track and audit.
However, security researcher Justin O’Leary has discovered a flaw in this system that allows an attacker to gain organization-level permissions. If an attacker has access to a Kubernetes namespace watched by KCC, permission to create IAMPolicyMember resources, and no Google Cloud credentials or permissions of their own, they can grant themselves any role assigned to KCC’s service account – including the ability to take ownership of the entire organization.
The attack itself is remarkably simple: a single YAML file describing an IAMPolicyMember resource is submitted through Kubernetes. The controller reads it and requests the IAM change from Google Cloud using its own credentials. In this way, an attacker can gain access to sensitive resources without ever having to log in or authenticate themselves directly with Google Cloud.
This vulnerability has serious implications for organizations that rely on KCC to manage their cloud infrastructure. With a single YAML file, an attacker can gain control over an entire organization’s resources – including sensitive data and critical systems. It is essential that administrators take immediate action to address this vulnerability and ensure the security of their cloud credentials.
To mitigate this risk, administrators should consider implementing additional controls and monitoring to detect and prevent unauthorized access to Kubernetes namespaces and IAMPolicyMember resources. This may involve restricting permissions, implementing access controls, and regularly auditing resource configurations.
In conclusion, while KCC has been hailed as a solution to secret sprawl, it appears that this approach also creates new risks and vulnerabilities. Organizations must be vigilant in monitoring their cloud credentials and take proactive steps to prevent unauthorized access to sensitive resources. By doing so, they can ensure the security of their cloud infrastructure and protect against potential threats.
Source: Bleeping Computer — 2026-09-23