k8s

I will say, there are a lot of things about kubernetes that are a total pain in the ass, but the ability to just write a few* lines of YAML and get a fully working application just like that is pretty freaking magical.

* log scale

#kubernetes #k8s

CVSS 10.0 in Google Config Connector — still unpatched.

Any K8s namespace user can become GCP Org Owner with 3 lines of YAML. Google's engineer said "Nice catch!" Then VRP called it "working as intended."

Their defense contradicts their own documentation.

The Register: https://www.theregister.com/security/2026/06/18/google-told-researcher-nice-catch-then-denied-bug-bounty-for-flaw-it-still-hasnt-fixed/5258076

Full writeup + video PoC: https://olearysec.com/research/config-connector-authorization-bypass

#infosec #cloudsecurity #gcp #kubernetes #bugbounty #vulnerability #google #k8s #iam #cybersecurity