Researchers have discovered a new loophole in Google Kubernetes Engine (GKE), which threat actors can utilize with a Google account to take over the misconfigured Kubernetes Cluster.
Threat actors can further use these compromised clusters for crypto mining, DoS (denial of service), and data theft. This loophole is dubbed “Sys:all” and affects more than 250,000 active GKE clusters, hundreds of them containing sensitive information.
This vulnerability exists due to the misconfiguration of RBAC bindings that result in system:authenticated groups having extreme privileges, potentially allowing any Google account holder to access and control vulnerable clusters.
Trustifi’s Advanced threat protection prevents the widest spectrum of sophisticated attacks before they reach a user’s mailbox. Try Trustifi Free Threat Scan with Sophisticated AI-Powered Email Protection .
According to the reports shared with Cyber Security News, researchers conducted an internet-wide scan that identified thousands of clusters that could potentially be exploited, including some publicly traded companies.
Additionally, a Python script and a Google authentication token were used to interact with the Kubernetes API of these clusters.
Moreover, there were also attempts to map these clusters to their respective organizations, which could potentially reveal their owners and the impact that could be made.
Most of the targeted data points were configmaps, Kubernetes secrets, service account details, and other critical operational data, which could provide a significant amount of information for attacking an organization.
The results of exploiting the misconfigurations had many more implications, which included allowing list and pulling images from the container registries and open access to AWS credentials within a cluster’s configmap.
However, with these credentials, it was possible to access S3 buckets, which had several sensitive information and logs, which had admin credentials alongside several valuable endpoints such as RabbitMQ, Elastic, authentication server, and internal systems.
The most interesting part is that all of these endpoints could be accessed with administrator privilege.
As of the initial access, the misconfigured GKE cluster allowed cluster-admin permissions to the system:authenticated group which enables querying multiple valuable resources using the Kubernetes API.
Inside the accessible resources, there were exposed AWS credentials (access key and secret key) within a bash script. This credential was further used to access S3 buckets for listing and downloading contents of multiple S3 buckets, some of which contained log files with operational data.
Following the examination of these logs, the researchers were able to find administrator credentials that can be used to log into various systems, including an internal platform.
Additionally, multiple important URLs to internal services such as ElasticSearch and RabbitMQ were also identified that could be accessed with superuser privileges.
A sophisticated cyber campaign orchestrated by the Chinese Advanced Persistent Threat (APT) group, Silver Fox,…
A new wave of cyberattacks attributed to the Ghostwriter Advanced Persistent Threat (APT) group has…
The LCRYX ransomware, a malicious VBScript-based threat, has re-emerged in February 2025 after its initial…
Recent cybersecurity investigations have uncovered a sophisticated technique employed by threat actors to evade detection…
A financial management app named Finance Simplified has been revealed as a malicious tool for…
A recent discovery by cybersecurity researchers has revealed that the Poseidon malware, a macOS-targeting trojan,…