All Topics
All Topics
Technology
Technology
AI
AI
Business
Business
Entertainment
Entertainment
News
News
Programming
Programming
Security
Security
Science
Science
Design
Design
Environment
Environment
Finance
Finance
Crypto
Crypto
Politics
Politics
Sports
Sports
Education
Education
Gaming
Gaming
Art
Art
Music
Music
Health
Health
Books
Books
Food
Food
Travel
Travel
Personal
Personal
Bluesky
Twitter

Google acknowledges Kubernetes operator security flaw but denies bug bounty, leaves vulnerability unpatched

By

Jessica Lyons

14d ago· 8 min readenNews
technologysecuritycloud computingbug bounty

Summary

Google has a security vulnerability in a Kubernetes operator that could allow attackers to bypass GCP's Identity and Access Management (IAM) protections and gain full control over cloud environments. Security researcher Justin O'Leary reported the flaw to Google, which initially acknowledged it with 'Nice catch!' but then denied a bug bounty, claiming the issue was 'working as intended.' The flaw remains unpatched, raising concerns about Google's bug bounty program transparency and its handling of security vulnerabilities.

Source

bskyGoogle acknowledges Kubernetes operator security flaw but denies bug bounty, leaves vulnerability unpatchedtheregister.com

Key quotes

· 3 pulled
'Nice catch!' Then denied bug bounty for flaw it still hasn't fixed
'Working as intended' for the win … again
EXCLUSIVE Google has a security hole in a Kubernetes operator that could allow attackers to bypass Google Cloud Platform (GCP) identity and access protections and gain full control over any organization's cloud environment
Snippet from the RSS feed
EXCLUSIVE 'Working as intended' for the win … again

You might also wanna read

Unpatched Argo CD Repo-Server Flaw Could Let Attackers Take Over Kubernetes Clusters

thehackernews.com·3d ago

Analyzing CVE-2026-31431: How Rootless Podman Containers Mitigate the "Copy Fail" Privilege Escalation

A technical deep-dive into CVE-2026-31431 ("Copy Fail"), a Linux kernel vulnerability. The author documents setting up a lab to run the expl

dragonsreach.it·2mo ago

Security Vulnerability: Google's Antigravity AI Susceptible to Indirect Prompt Injection Attacks

The article describes a security vulnerability where Google's Antigravity AI system (likely referring to Gemini) can be manipulated through

promptarmor.com·7mo ago

Analysis of CVE-2026-4020: Coordinated Google Cloud Fleet Exploiting Gravity SMTP WordPress Vulnerability

A detailed technical analysis of CVE-2026-4020, a critical vulnerability in the Gravity SMTP WordPress plugin that exposed sensitive credent

honeylabs.net·17d ago

Windows Defender Vulnerability Allows Malicious File Persistence Through Cloud Tag Detection

The article describes a GitHub repository called 'RedSun' that documents a Windows Defender vulnerability. The vulnerability involves Window

github.com·2mo ago

The Global Namespace Risk: Universal Bucket Hijacking Technique for Cloud Data Exfiltration

unit42.paloaltonetworks.com·12d ago

Comments

Sign in to join the conversation.

No comments yet. Be the first.