In plain language
What this advisory means
A security flaw in Google Kubernetes Engine (GKE) Multi-Cloud APIs allowed attackers to add a cluster to any target project's Workload Identity Federation, which could let them impersonate Kubernetes service accounts in that project. This could let attackers misuse identities and access resources without proper permission.
Technical explanation
How the issue affects the environment
The CreateAttachedCluster, CreateAwsCluster, and CreateAzureCluster APIs in GKE Multi-Cloud lacked project permission checks. This allowed an attacker to register an attached cluster into an arbitrary target project's Workload Identity Federation for GKE. By doing so, the attacker could create Workload Identity tokens without authorization and impersonate Kubernetes Service Accounts bound in the target project through the Workload Identity Federation configuration. This bypasses proper security controls and could result in unauthorized access within the target project.
Operational impact
Why teams should care
Unauthorized attackers registering clusters within target projects could impersonate Kubernetes service accounts, potentially gaining unauthorized access or executing actions in cloud environments. This undermines the intended security boundaries, risking data exposure, privilege escalation, and control over cloud resources, adversely affecting business operations and trust in the service.
Immediate action
Google has provided instructions and details in the GKE security bulletin. Users should follow the recommended guidance in the bulletin to secure their environments and mitigate the issue.
Affected and fixed releases
Temporary risk reduction
No separate workaround was supplied in the source feed. Use the official vendor advisory before changing production controls.
Evidence and validation checklist
- Missing project permission check in GKE Multi-Cloud cluster creation APIs
- Ability to register attached clusters into arbitrary target projects' Workload Identity Federation
- Unauthorized creation of Workload Identity tokens
- Impersonation of Kubernetes Service Accounts with bindings in target projects through federation configuration
- Details and instructions provided in GKE security bulletin
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.