GOOGLE FIXES CLOUD COMPOSER PRIVILEGE ESCALATION VULNERABILITY

Summary from the TLDR InfoSec newsletter

Google has fixed a privilege escalation vulnerability impacting the Cloud Composer 2 managed workflow orchestration service. Cloud Composer allows any user with edit permissions to install a package from PyPi, which is then installed by Cloud Build. Prior to this fix, Cloud Build used the highly privileged default Cloud Build service account. An attacker could install a malicious PyPi package that exfiltrates the sensitive Cloud Build credentials.