Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459)
Researcher discloses an unpatched credential leak in Kubernetes cloud-provider-gcp after Google's deadline passed.
Nebojša Jaćović disclosed an unpatched credential leak in kubernetes/cloud-provider-gcp, in the auth-provider-gcp component, after reporting it to the Google Cloud Vulnerability Reward Program on 14 June 2026. He says the 6 October 2026 deadline passed with only automated acknowledgments and a priority change to P2, and that the flaw was still present on master as of 11 October 2026. A CVE has been requested and is cited as CAN-2026-2039459. The post does not describe exploitation.
- Credential leak is in kubernetes/cloud-provider-gcp auth-provider-gcp.
- Reported to Google Cloud VRP on 14 June 2026 as issue 523808414.
- Researcher says master was still affected on 11 October 2026.
- A CVE was requested under candidate id CAN-2026-2039459.
- Vendors
- Products
- Kubernetescloud-provider-gcp
- Organizations
- Google Cloud Vulnerability Reward Program
From the original article
Posted by Nebojša Jaćović on Oct 12 Hi, I'm disclosing a vulnerability in kubernetes/cloud-provider-gcp that I reported to Google Cloud VRP on 2026-06-14 (Issue #523808414). The 90-day disclosure deadline I communicated to the vendor (2026-10-06) has passed with no substantive response beyond automated queue acknowledgments and a priority reassignment to P2.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.