How the Sys:All Loophole Allowed Us to Penetrate GKE Clusters in Production

Originally published by Orca Security. Written by Ofir Yakobi. Following our discovery of a critical loophole in Google Kubernetes Engine (GKE) dubbed Sys:All, we decided to conduct research into the real-world impacts of this issue. Our initial probe already revealed over a thousand vulnerable GKE clusters due to admins configuring RBAC bindings making the system:authenticated group overprivileged, which could potentially allow any Google account holder to access and control these clusters.G...

clusters critical discovery engine gke google google kubernetes engine issue kubernetes orca orca security probe production real research security vulnerable world written