GOOGLE ACCOUNT MISCONFIG LETS ANY GMAIL ACCOUNT CONTROL YOUR CLUSTER

Summary from the TLDR InfoSec newsletter

Orca has discovered a new vulnerability, dubbed Sys:All, which impacts an estimated 250,000 GKE clusters. Orca researchers said that the vulnerability stems from a misunderstanding whereby users believe that the system:authenticated group in GKE includes only verified and deterministic identities as opposed to any Google authenticated account. This means that any Google user can obtain an OAuth bearer token and utilize it to authenticate to the GKE cluster and obtain any overly permissive permissions granted to the system:authenticated group.