In plain language
What this advisory means
A security flaw was found in the Google Kubernetes Engine (GKE) Multi-Cloud APIs that manage clusters attached from AWS and Azure. Due to a missing project permission check, an attacker could register a cluster in another customer's project without authorization. This allowed them to create identity tokens and impersonate Kubernetes service accounts linked to that project, posing a serious security risk.
Technical explanation
How the issue affects the environment
The vulnerability involved a missing project-level permission check in the GKE Multi-Cloud API methods CreateAttachedCluster, CreateAwsCluster, and CreateAzureCluster. Because of this, an attacker could register a malicious attached cluster within any arbitrary target project's Workload Identity Federation for GKE. This unauthorized registration enabled the attacker to create Workload Identity tokens and impersonate Kubernetes Service Accounts that have role bindings in the target project, exploiting the Workload Identity Federation configuration.
Operational impact
Why teams should care
Exploitation enables attackers to impersonate Kubernetes service accounts bound to the victim's project. This could lead to unauthorized access to cloud resources and services that depend on these identities, severely impacting the security and integrity of the victim's GKE workloads and cloud environment.
Immediate action
Google has published detailed instructions and updates in the GKE security bulletin to address this issue. Customers should follow the guidance to ensure proper permission checks and prevent unauthorized cluster registrations.
Affected and fixed releases
Temporary risk reduction
No separate workaround was supplied in the source feed. Use the official vendor advisory before changing production controls.
Evidence and validation checklist
- Official Google Cloud Security Bulletin for GCP-2026-058
- Description of missing project permission check in GKE Multi-Cloud APIs
- Exploit allowing unauthorized Workload Identity token creation and Kubernetes Service Account impersonation
- No CVE assigned yet and no exploitation status specified
Authoritative reference
Google Cloud Security Bulletins
QCS detected and normalized this record from the official source. Vendor guidance remains authoritative.
