CERT24How One Kubernetes YAML Can Hand Over a GCP Organization
A Google Kubernetes Config Connector (KCC) configuration can create a privilege-escalation path when the KCC service account has organization-level IAM permissions and users have broad write access to KCC-managed Kubernetes namespaces.