On 12 October 2026, the oss-sec mailing list published a vulnerability report for the kubernetes/cloud-provider-gcp component, which connects Kubernetes clusters to cloud providers. According to the report, the flaw is a credential leak. The author states that the problem remains in the project's master branch.
The facts stated in the report are these. The flaw was reported to the Google Cloud vulnerability reward program on 14 June 2026. On 6 October 2026, the 90-day disclosure deadline communicated to the vendor passed without a substantive reply; there were only automatic receipt confirmations and a priority change to P2. On 11 October 2026, the author says they independently confirmed the problem is still present in master. A CVE identifier has been requested. The available text is a machine translation of content originally published on the list, and it contains no exploitation details.
The relevance for organizations running Kubernetes clusters in the cloud is to monitor the component's status, any published fix, and CVE assignment. Until a fix exists, it is worth reviewing where these credentials are used and considering rotation if exposure is suspected. Rota Nacional does not operate this component, does not fix third-party code, and does not resolve the flaw described.
To verify the information, consult the original oss-sec archive referenced in the source item, compare it with the upstream project repository, and check public CVE databases once an identifier is assigned. Also review the original English text, since the version consulted is a machine translation.