Security Advisory Desk
unratedQCS priority 70/100Google Cloud

GCP-2026-058

A security flaw was found in the Google Kubernetes Engine (GKE) Multi-Cloud APIs that manage clusters attached from AWS and Azure. Due to a missing project permission check, an attacker could register a cluster in another customer's project without authorization. This allowed them to create identity tokens and impersonate Kubernetes service accounts linked to that project, posing a serious security risk.

Published 11/9/2026, 2:57:02 pmVerified 12/9/2026, 9:34:57 amRevision 4
Google Cloud unrated network security advisory visual

In plain language

What this advisory means

A security flaw was found in the Google Kubernetes Engine (GKE) Multi-Cloud APIs that manage clusters attached from AWS and Azure. Due to a missing project permission check, an attacker could register a cluster in another customer's project without authorization. This allowed them to create identity tokens and impersonate Kubernetes service accounts linked to that project, posing a serious security risk.

Technical explanation

How the issue affects the environment

The vulnerability involved a missing project-level permission check in the GKE Multi-Cloud API methods CreateAttachedCluster, CreateAwsCluster, and CreateAzureCluster. Because of this, an attacker could register a malicious attached cluster within any arbitrary target project's Workload Identity Federation for GKE. This unauthorized registration enabled the attacker to create Workload Identity tokens and impersonate Kubernetes Service Accounts that have role bindings in the target project, exploiting the Workload Identity Federation configuration.

Operational impact

Why teams should care

Exploitation enables attackers to impersonate Kubernetes service accounts bound to the victim's project. This could lead to unauthorized access to cloud resources and services that depend on these identities, severely impacting the security and integrity of the victim's GKE workloads and cloud environment.

Immediate action

Google has published detailed instructions and updates in the GKE security bulletin to address this issue. Customers should follow the guidance to ensure proper permission checks and prevent unauthorized cluster registrations.

Affected and fixed releases

Affected versionsConfirm in the official vendor advisory
Fixed versionsConfirm in the official vendor advisory

Temporary risk reduction

No separate workaround was supplied in the source feed. Use the official vendor advisory before changing production controls.

Evidence and validation checklist

  • Official Google Cloud Security Bulletin for GCP-2026-058
  • Description of missing project permission check in GKE Multi-Cloud APIs
  • Exploit allowing unauthorized Workload Identity token creation and Kubernetes Service Account impersonation
  • No CVE assigned yet and no exploitation status specified

Authoritative reference

Google Cloud Security Bulletins

QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.

Open source