Google Kubernetes Clusters Suffer Widespread Exposure to External Attackers

Orca Security disclosed a GKE authentication misconfiguration dubbed 'Sys:All' in which administrators binding the Kubernetes 'system:authenticated' group unintentionally grant access to any Google-account holder; researchers found hundreds of reachable vulnerable clusters (and estimate the true scope may exceed one million), demonstrated proof-of-concept compromises that exposed credentials and internal services, and prompted Google to issue mitigations (including blocking cluster-admin binding in GKE 1.28+), while advising least-privilege and continuous monitoring.