Posted by Nebojša Jaćović on Oct 12 Hi, I'm disclosing a vulnerability in kubernetes/cloud-provider-gcp that I reported to Google Cloud VRP on 2026-06-14 (Issue #523808414). The 90-day disclosure deadline I communicated to the vendor (2026-10-06) has passed with no substantive response beyond automated queue acknowledgments and a priority reassignment to P2. I've independently reconfirmed the issue remains present in master as of 2026-10-11.
Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459)
About this summary. This is a short, independently written summary of an article first published by oss-security. Cyber Security News did not report or verify the underlying story. Read the original: https://seclists.org/oss-sec/2026/q4/133
Source attribution: headline and facts are from oss-security (seclists.org). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
Containing the Autonomous Operator: A Defense-in-Depth Framework and Reference Architecture for Securing AI Agents on Kubernetes
arXiv:2610.02861v1 Announce Type: new Abstract: Large language model (LLM) agents are moving from chat interfaces into infrastructure operations, where they read…
How One Kubernetes YAML Can Hand Over a GCP Organization
A Kubernetes user with limited permissions can potentially gain control of an entire Google Cloud organization by exploiting the authority granted to Google Kubernetes…
Federal agencies recommend cyber controls, independent testing for frontier AI systems
The federal government is advising AI companies to set more industry standards for securing agents in sandbox testing environments.
Google security advisory (AV26-1060)
Serial number: AV26-1060 Date: October 16, 2026 As of October 15, 2026, Google is affected by vulnerabilities in the following product: Chrome Versions prior to…
Prolific Chinese espionage group exploits BeyondTrust zero-day
Suspected Chinese hackers with a proven knack for exploiting zero-days in security products are at it again, targeting BeyondTrust customers in attacks that researchers…
Attackers Tampered with AOMEI Backupper's Update Servers for Minutes to Deliver a Backdoor
Attackers repeatedly changed the files that AOMEI Backupper fetches from the vendor's own update servers, in windows of five to ten minutes at a time between May and…