gcp

CVSS 10.0 in Google Config Connector — still unpatched.

Any K8s namespace user can become GCP Org Owner with 3 lines of YAML. Google's engineer said "Nice catch!" Then VRP called it "working as intended."

Their defense contradicts their own documentation.

The Register: https://www.theregister.com/security/2026/06/18/google-told-researcher-nice-catch-then-denied-bug-bounty-for-flaw-it-still-hasnt-fixed/5258076

Full writeup + video PoC: https://olearysec.com/research/config-connector-authorization-bypass

#infosec #cloudsecurity #gcp #kubernetes #bugbounty #vulnerability #google #k8s #iam #cybersecurity