Unpatched cross-namespace secret exfiltration in k8s-config-connector; CVE requested

The advisory, published on 12/10/2026 in the oss-sec feed as an automatic translation, describes a cross-namespace secret exfiltration flaw in the GoogleCloudPlatform/k8s-config-connector project. The author says he reported the issue to the Google Cloud VRP on 17/06/2026 and that the 90-day disclosure deadline, ending on 09/10/2026, passed without a substantive response, with only automatic receipt confirmations. He states he independently confirmed the problem remains on the master branch as of 11/10/2026. A CVE ID has been requested from MITRE's CNA-LR. The available excerpt does not detail the technical mechanism, the affected versions or a fix. Why it matters: teams that use the project to manage cloud resources through Kubernetes may have secrets reachable from other namespaces. General measures include reviewing RBAC permissions per namespace, limiting who can read secrets, following the official advisory and CVE, and considering credential rotation if exposure is suspected. Rota Nacional does not fix, audit or monitor Kubernetes cluster configurations. If a reader uses AI to study this advisory, they should remove cluster names, tokens, passwords, keys and manifests containing secret values before sending. Check the original, linked from the oss-sec feed itself, and do not rely only on the automatic translation.