GCP-2025-062
A Linux kernel vulnerability (CVE-2024-58240) affecting Container-Optimized OS nodes in Google Kubernetes Engine (GKE) clusters can lead to privilege escalation. This impacts GKE Standard and Autopilot clusters but not those using GKE Sandbox. Patch versions have been released for Ubuntu node pools and Container-Optimized OS node pools across multiple GKE versions. GDC software for VMware is also affected and patched. GKE on AWS and Azure patch details are pending. Bare metal GDC software is not affected and requires no action.
AI Analysis
Technical Summary
CVE-2024-58240 is a Linux kernel vulnerability discovered in Container-Optimized OS nodes used in various Google Kubernetes Engine (GKE) environments. This vulnerability allows privilege escalation on affected nodes. GKE Standard and Autopilot clusters are impacted, while GKE Sandbox clusters are not. Google has released patches for Ubuntu node pools and Container-Optimized OS node pools in specific GKE versions, including 1.28.15-gke.2740000, 1.29.15-gke.1979000, 1.30.14-gke.1267000, and 1.31.13-gke.1040000 among others. GDC software for VMware clusters is also affected and patched in version 1.31.1000-gke.44 or later. Patch versions and severity assessments for GKE on AWS and Azure are still pending. Bare metal GDC software is not affected as it does not include an operating system. The vulnerability is rated as high severity where assessed.
Potential Impact
The vulnerability enables privilege escalation on Container-Optimized OS nodes within affected GKE clusters, potentially allowing attackers to gain elevated privileges on these nodes. This could compromise the security boundary of containerized workloads running on these nodes. GKE Sandbox clusters are not impacted. Bare metal GDC software is unaffected. The impact is rated high severity for affected environments where patches have been released.
Mitigation Recommendations
Upgrade affected GKE node pools to the specified patched versions or later. For Ubuntu node pools, upgrade to at least 1.28.15-gke.2740000, 1.29.15-gke.1979000, 1.30.14-gke.1267000, or 1.31.13-gke.1040000. For Container-Optimized OS node pools, upgrade to at least 1.32.9-gke.1010000, 1.28.15-gke.2740000, 1.29.15-gke.1936000, 1.31.12-gke.1220000, or 1.30.14-gke.1267000. For GDC software on VMware, upgrade to version 1.31.1000-gke.44 or later. No action is required for GDC bare metal software as it is not affected. Monitor the vendor advisory for updates on GKE on AWS and Azure patch availability and severity assessments.
GCP-2025-062
Description
A Linux kernel vulnerability (CVE-2024-58240) affecting Container-Optimized OS nodes in Google Kubernetes Engine (GKE) clusters can lead to privilege escalation. This impacts GKE Standard and Autopilot clusters but not those using GKE Sandbox. Patch versions have been released for Ubuntu node pools and Container-Optimized OS node pools across multiple GKE versions. GDC software for VMware is also affected and patched. GKE on AWS and Azure patch details are pending. Bare metal GDC software is not affected and requires no action.
Affected software
pkg:github/google/kubernetes-engineRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
CVE-2024-58240 is a Linux kernel vulnerability discovered in Container-Optimized OS nodes used in various Google Kubernetes Engine (GKE) environments. This vulnerability allows privilege escalation on affected nodes. GKE Standard and Autopilot clusters are impacted, while GKE Sandbox clusters are not. Google has released patches for Ubuntu node pools and Container-Optimized OS node pools in specific GKE versions, including 1.28.15-gke.2740000, 1.29.15-gke.1979000, 1.30.14-gke.1267000, and 1.31.13-gke.1040000 among others. GDC software for VMware clusters is also affected and patched in version 1.31.1000-gke.44 or later. Patch versions and severity assessments for GKE on AWS and Azure are still pending. Bare metal GDC software is not affected as it does not include an operating system. The vulnerability is rated as high severity where assessed.
Potential Impact
The vulnerability enables privilege escalation on Container-Optimized OS nodes within affected GKE clusters, potentially allowing attackers to gain elevated privileges on these nodes. This could compromise the security boundary of containerized workloads running on these nodes. GKE Sandbox clusters are not impacted. Bare metal GDC software is unaffected. The impact is rated high severity for affected environments where patches have been released.
Mitigation Recommendations
Upgrade affected GKE node pools to the specified patched versions or later. For Ubuntu node pools, upgrade to at least 1.28.15-gke.2740000, 1.29.15-gke.1979000, 1.30.14-gke.1267000, or 1.31.13-gke.1040000. For Container-Optimized OS node pools, upgrade to at least 1.32.9-gke.1010000, 1.28.15-gke.2740000, 1.29.15-gke.1936000, 1.31.12-gke.1220000, or 1.30.14-gke.1267000. For GDC software on VMware, upgrade to version 1.31.1000-gke.44 or later. No action is required for GDC bare metal software as it is not affected. Monitor the vendor advisory for updates on GKE on AWS and Azure patch availability and severity assessments.
Technical Details
- Classification
- {"confidence":0.83,"severitySource":"heuristic","classifier":"rss-v2"}
- Article Source
- {"url":"https://docs.cloud.google.com/kubernetes-engine/security-bulletins#gcp-2025-062","fetched":true,"fetchedAt":"2026-08-04T13:02:34.260Z","wordCount":93147}
Threat ID: 6a71e2f5bf8831d539d622b9
Added to database: 08/04/2026, 13:02:45 UTC
Last enriched: 08/04/2026, 13:19:44 UTC
Last updated: 08/04/2026, 16:18:49 UTC
Views: 5
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.