Google Kubernetes Engine Vulnerabilities Could Allow Cluster Takeover

Palo Alto Networks Unit 42 identified a privilege-escalation chain in Google Kubernetes Engine where the default FluentBit DaemonSet (which mounts /var/lib/kubelet/pods and exposes projected service account tokens) combined with excessive Anthos Service Mesh CNI DaemonSet permissions can let an attacker with container access or RCE impersonate privileged pods and escalate to cluster-admin; Google released fixes in security bulletin GCP-2023-047 on 14 December 2023 and users are urged to update FluentBit, review and reduce ASM/GKE component privileges, and monitor for suspicious activity.