Executive Summary

Google Cloud has released an advisory and deployed a global platform fix for CVE-2026-69210, a critical privilege escalation and cross-tenant impersonation flaw within Cloud IAM Workload Identity Federation. With a CVSS v3.1 score of 9.4 (Critical), the flaw permitted external workloads—such as GitHub Actions runners, GitLab CI jobs, and AWS IAM roles—to exchange malformed OpenID Connect (OIDC) identity tokens for privileged Google Cloud service account credentials.

Workload Identity Federation is the recommended keyless authentication architecture for GCP, allowing workloads outside Google Cloud to impersonate service accounts without storing long-lived service account JSON keys. CVE-2026-69210 undermined this trust boundary by exploiting normalization inconsistencies in the Google Cloud Security Token Service (STS).

Vulnerability Mechanics: Normalization Ambiguity in OIDC Audience Claims

When an external identity provider signs an OIDC JSON Web Token (JWT), it includes an aud (audience) claim specifying the intended recipient. In Google Cloud Workload Identity Federation, the expected audience format is:

// Format:
// https://iam.googleapis.com/projects/{PROJECT_NUMBER}/locations/global/workloadIdentityPools/{POOL_ID}/providers/{PROVIDER_ID}

Security researchers discovered that the token exchange validation engine in sts.googleapis.com utilized a relaxed URI normalization algorithm before verifying attribute mappings. By appending percent-encoded null bytes or path traversal characters to the audience claim, an attacker could satisfy signature validation while causing the pool matcher to select a different target project's identity pool mapping.

{
  "iss": "https://token.actions.githubusercontent.com",
  "sub": "repo:attacker/malicious-repo:ref:refs/heads/main",
  "aud": "https://iam.googleapis.com/projects/123456789/locations/global/workloadIdentityPools/prod-pool/providers/gh-provider%2f..%2f..%2f..%2fvictim-pool",
  "exp": 1791600000
}

Because the signature verification verified that the token originated from GitHub's legitimate OIDC issuer, the malformed URI path confused the tenant router, allowing tokens originating from unapproved third-party repositories to assume service accounts mapped in the victim project.

Blast Radius & Enterprise Exposure

The severity of CVE-2026-69210 was heavily dictated by how organizations configured their attribute mapping conditions. Organizations that mapped external identities directly without specifying granular attribute_condition filters were directly vulnerable to unauthorized service account generation.

If an attacker successfully exchanged an external OIDC token for an STS federated token, they could call the iamcredentials.googleapis.com:generateAccessToken API to obtain short-lived OAuth 2.0 access tokens. If the target service account held high-level roles (such as roles/editor or roles/storage.admin), the attacker gained immediate read/write access to production cloud resources.

Remediation & Hardening Recommendations

Google Cloud resolved the normalization bug centrally across all regional and global STS endpoints. No customer service disruption or manual patch deployment was required on Google Cloud infrastructure. However, security teams must audit their Workload Identity Federation implementations to ensure defense-in-depth:

  • Enforce Explicit Attribute Conditions: Always enforce granular attribute filtering in identity pools. For example, in GitHub Actions integrations, restrict access strictly to specific organization and repository names: 
    gcloud iam workload-identity-pools providers update-oidc gh-provider     --workload-identity-pool="prod-pool"     --attribute-condition="assertion.repository_owner == 'EnterpriseOrg' && assertion.ref == 'refs/heads/main'"
  • Audit Service Account Token Creator Roles: Ensure that only necessary Workload Identity user principals hold the roles/iam.workloadIdentityUser role on sensitive service accounts.
  • Activate VPC Service Controls (VPC-SC): Configure service perimeters around sensitive APIs (e.g., Cloud Storage, BigQuery, Compute Engine) so that even if an access token is compromised externally, API requests originating from unauthorized IP ranges are blocked.