Google Cloud Patches Critical GKE Multi-Cloud Flaw Enabling Cross-Project Cluster Hijack and Service Account Impersonation

Executive Summary: Cloud Mesh Authorization Collapse

Google Cloud Platform (GCP) engineering teams have quietly deployed critical remediation for an architectural authorization bypass tracked under advisory identifier GCP-2026-058. The vulnerability compromised the identity federation boundaries of Google Kubernetes Engine (GKE) Multi-Cloud—the hybrid enterprise service designed to manage, monitor, and enforce centralized policy across Kubernetes clusters operating natively in Amazon Web Services (AWS), Microsoft Azure, and bare-metal on-premises data centers.

Security researchers auditing GKE Multi-Cloud onboarding workflows discovered that the foundational cluster provisioning endpoints—specifically CreateAttachedCluster, CreateAwsCluster, and CreateAzureCluster—failed to validate caller authorization against the destination GCP Project ID specified in the API payload. Consequently, any authenticated Google Cloud user who acquired or enumerated a target enterprise's public or semi-private GCP Project Number could remotely bind an attacker-controlled external Kubernetes cluster into the victim's dedicated Workload Identity pool.

Once attached, pods executing within the rogue cluster could request cryptographic identity tokens mapped to legitimate victim Google Service Accounts (GSAs). This effectively breached tenant isolation and permitted arbitrary API execution across victim cloud infrastructure, encompassing Cloud Storage buckets, BigQuery analytics warehouses, and Secret Manager vaults without triggering traditional perimeter alarms.

Root Cause Analysis: Flawed Identity Federation Binding

To understand the severity of GCP-2026-058, one must dissect how GKE Workload Identity Federation translates ephemeral Kubernetes Service Account (KSA) JSON Web Tokens (JWTs) into authenticated Google Cloud OAuth2 bearer credentials. Under normal multi-cloud operations, an enterprise establishes a trust relationship between an external Kubernetes cluster's OIDC issuer URL and a dedicated Google Cloud Identity Pool.

When an administrator registers an AWS EKS or Azure AKS cluster into Anthos / GKE Multi-Cloud, the management control plane invokes the GKE Multi-Cloud API:

POST /v1/projects/{projectNumber}/locations/{location}/awsClusters
Host: gkemulticloud.googleapis.com
Authorization: Bearer ya29.a0AfH6SM...
Content-Type: application/json

{
  "name": "projects/104928172910/locations/us-west1/awsClusters/finance-prod-cluster",
  "awsRegion": "us-west-2",
  "awsFleet": {
    "project": "projects/104928172910"
  },
  "controlPlane": {
    "awsServicesAuthentication": {
      "roleArn": "arn:aws:iam::123456789012:role/gke-multicloud-control-plane"
    }
  },
  "oidcConfig": {
    "issuerUrl": "https://oidc.eks.us-west-2.amazonaws.com/id/EXAMPLED3B4C5A"
  }
}

The architectural failure resided in the gateway authorization handler. The service verified whether the caller possessed valid IAM credentials to call the API in their own active tenant, but omitted an explicit check confirming that the caller held gke.multicloud.clusters.create or resourcemanager.projects.get permissions on the destination projects/{projectNumber} object referenced in the URI path and fleet definition.

The Token Forgery & Impersonation Pipeline

Because project numbers are easily discoverable via shared Cloud Storage metadata, public Google Cloud Armor endpoints, or misconfigured API responses, an attacker could mount the following multistage compromise:

1. Project Identification: Discover target corporation Project Number (e.g., 104928172910).
2. Rogue Cluster Provisioning: Deploy an inexpensive standalone Kubernetes cluster in an attacker AWS or Azure subscription.
3. Malicious Cluster Binding: Call CreateAttachedCluster targeting projects/104928172910/locations/global/attachedClusters/attacker-node, providing the OIDC issuer URL of the attacker cluster.
4. Namespace Mirroring: Create a namespace and service account in the attacker cluster matching an existing privileged binding in the victim tenant (e.g., namespace: payment-backend, serviceAccount: ledger-sync).
5. Token Exchange: The attacker pod contacts Google's Security Token Service (STS) endpoint (sts.googleapis.com) presenting its pod service account JWT. STS validates the token against the attacker OIDC issuer (which Google's control plane legitimately registered under the victim project) and returns a federated GCP credential authorized to impersonate ledger-sync@victim-project.iam.gserviceaccount.com.

Defensive Remediation & Investigation Playbook

Google Cloud has remediated the issue globally across all production API gateways by enforcing mandatory project-level RBAC checks (gkemulticloud.operations.create) prior to parsing registration requests. However, enterprise security operations must perform retrospective audits to verify that no rogue clusters were attached prior to the server-side rollout.

1. Automated Multi-Cloud Cluster Inventory Audit

Execute the following gcloud commands to list all currently registered attached, AWS, and Azure clusters across all active projects and verify their originating OIDC identity issuers:

#!/usr/bin/env bash
# Audit all registered GKE Multi-Cloud clusters for unrecognized OIDC issuers

echo "[+] Auditing GKE Attached Clusters..."
gcloud container attached clusters list --format="table(name,platformVersion,oidcConfig.issuerUrl)"

echo "[+] Auditing GKE AWS Clusters..."
gcloud container aws clusters list --format="table(name,awsRegion,oidcConfig.issuerUrl)"

echo "[+] Auditing GKE Azure Clusters..."
gcloud container azure clusters list --format="table(name,azureRegion,oidcConfig.issuerUrl)"

2. Cloud Audit Log Telemetry Inspection

Query Google Cloud Logging for historical invocations of multi-cloud cluster attachment methods over the preceding 90 days. Alert immediately on any registration event where the caller identity (protoPayload.authenticationInfo.principalEmail) does not belong to your authorized corporate domain:

protoPayload.serviceName="gkemulticloud.googleapis.com"
AND protoPayload.methodName:(
  "google.cloud.gkemulticloud.v1.AttachedClusters.CreateAttachedCluster" OR
  "google.cloud.gkemulticloud.v1.AwsClusters.CreateAwsCluster" OR
  "google.cloud.gkemulticloud.v1.AzureClusters.CreateAzureCluster"
)
AND NOT protoPayload.authenticationInfo.principalEmail=~"@corp-enterprise\.com$"

Architectural Verification Matrix

API Endpoint	Vulnerable Method	CWE Mapping	Remediation Mechanism	Customer Action Required
CreateAttachedCluster	Missing Destination Project Check	CWE-285 (Improper Authorization)	Server-Side Project RBAC Enforcement	Audit Registered Clusters & Logs
CreateAwsCluster	Missing Destination Project Check	CWE-285 (Improper Authorization)	Server-Side Project RBAC Enforcement	Audit Registered Clusters & Logs
CreateAzureCluster	Missing Destination Project Check	CWE-285 (Improper Authorization)	Server-Side Project RBAC Enforcement	Audit Registered Clusters & Logs

Workload Identity Hardening Recommendations

To prevent similar identity federation abuse across hybrid multi-cloud environments, cloud architects should adhere to the following defensive postures:

• Strict Issuer Allowlisting: Restrict Workload Identity Federation pools to explicitly validated AWS Account IDs and Azure Tenant IDs using IAM attribute condition expressions (attribute.aws_account == '123456789012').
• Project Number Obfuscation: Avoid exposing numeric GCP Project IDs in public-facing API endpoints, web headers, or external DNS records.
• Enforce VPC Service Controls: Configure Service Perimeters restricting Google Security Token Service (STS) and IAM credential exchange to corporate egress IP addresses and authorized VPC subnets.