Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-2039460)
An unpatched Config Connector flaw can exfiltrate secrets across Kubernetes namespaces after Google did not substantively respond.
A researcher disclosed an unpatched cross-namespace secret-exfiltration flaw in GoogleCloudPlatform/k8s-config-connector. It was reported to the Google Cloud VRP on June 17, 2026, and the stated 90-day deadline of October 9 passed with only automated acknowledgments. The issue was reconfirmed on master as of October 11, 2026, and a CVE has been requested under candidate identifier CAN-2026-2039460. No exploitation is described.
- Config Connector can exfiltrate secrets across Kubernetes namespaces.
- The flaw was reconfirmed on master on October 11, 2026.
- Google Cloud VRP sent only automated acknowledgments before the deadline.
- Researcher requested a CVE; identifier CAN-2026-2039460 is not assigned.
- Vendors
- Products
- Config ConnectorKubernetes
- Organizations
- Google CloudMITRE
From the original article
Posted by Nebojša Jaćović on Oct 12 Hi, I'm disclosing a vulnerability in GoogleCloudPlatform/k8s-config-connector that I reported to Google Cloud VRP on 2026-06-17. The 90-day disclosure deadline I communicated to the vendor (2026-10-09) has passed with no substantive response beyond automated queue acknowledgments. I've independently reconfirmed the issue remains present in master as of 2026-10-11.
seclists.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.