ConfusedFunction Flaw in Google Cloud Lets Hackers Escalate Privileges

ConfusedFunction is a privilege-escalation vulnerability in Google Cloud Functions where a default Cloud Build service account with excessive permissions is attached to background Cloud Build instances during deployments; attackers can publish a malicious dependency (e.g., an npm package with a preinstall script) that executes in the build environment, retrieves the Cloud Build service account token from the metadata service, and exfiltrates it to impersonate the account and access GCP resources. Google introduced options to use a custom, limited service account and changed the default to the Compute Engine service account for new deployments, but existing Cloud Build service accounts may still retain excessive permissions and require remediation and monitoring.