Skip to content
NewA calmer, faster ZeroHour
StoryVulnerabilityhigh

Two unpatched Google Kubernetes flaws disclosed after VRP deadlines

1 source · 2 articlesFirst reported Updated ()1 · 1 read
What's new

First coverage.

Merged summary · grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Researchers disclosed two unpatched Google Kubernetes issues, a credential leak and cross-namespace secret exfiltration, after VRP deadlines passed without substantive fixes.

Two separate unpatched flaws in Google-related Kubernetes projects were disclosed on oss-security on 12 October 2026 after Google Cloud Vulnerability Reward Program deadlines passed with only automated acknowledgments. Nebojša Jaćović reported a credential leak in kubernetes/cloud-provider-gcp’s auth-provider-gcp component on 14 June 2026 as issue 523808414; he said the 6 October 2026 deadline passed, priority was changed to P2, and master was still affected on 11 October 2026. A CVE was requested under candidate identifier CAN-2026-2039459. Separately, a researcher reported a cross-namespace secret-exfiltration flaw in GoogleCloudPlatform/k8s-config-connector on 17 June 2026; the stated 90-day deadline of 9 October 2026 passed, the issue was reconfirmed on master on 11 October 2026, and candidate identifier CAN-2026-2039460 was requested but is not assigned. Neither post describes exploitation. The reports cover different components and do not contradict each other.

Key facts
  • Credential leak is in kubernetes/cloud-provider-gcp, component auth-provider-gcp; CVE candidate CAN-2026-2039459 was requested.
  • Nebojša Jaćović reported it to the Google Cloud VRP on 14 June 2026 as issue 523808414; he says the 6 October 2026 deadline passed with only automated acknowledgments and a priority change to P2.
  • He says master was still affected on 11 October 2026; the post does not describe exploitation.
  • A separate unpatched flaw in GoogleCloudPlatform/k8s-config-connector can exfiltrate secrets across Kubernetes namespaces; candidate id CAN-2026-2039460 was requested and is not assigned.
  • That issue was reported to the Google Cloud VRP on 17 June 2026; the stated 90-day deadline of 9 October 2026 passed with only automated acknowledgments.
  • It was reconfirmed on master as of 11 October 2026; no exploitation is described.
Analyze this story with Vani AIImpact, who is affected and what defenders should do, in a new chat
Vendors
Google
Products
Config ConnectorKubernetescloud-provider-gcp
Organizations
Google CloudMITREGoogle Cloud Vulnerability Reward Program

Coverage

oldest first · one row per article · UTC
  1. · 18d ago oss-securityFirst report

    Unpatched credential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE requested (CAN-2026-2039459)

    Researcher discloses an unpatched credential leak in Kubernetes cloud-provider-gcp after Google's deadline passed.

  2. · 18d ago oss-security

    Unpatched cross-namespace secret exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE requested (CAN-2026-2039460)

    An unpatched Config Connector flaw can exfiltrate secrets across Kubernetes namespaces after Google did not substantively respond.