Kubernetes YAML Misconfiguration Leads to GCP Organization Takeover

Researchers have discovered a confused deputy vulnerability where low-privileged Kubernetes users can leverage the Google Kubernetes Config Connector to escalate privileges and gain control over an entire Google Cloud organization. By deploying a crafted YAML file, attackers can bypass permission boundaries within cloud environments.