GCP-2026-071
Source GCP Kubernetes Security
No CVSS score published yet
- Exploitation
Not in CISA KEV, no exploitation reported
- EPSS
- 0.1% chance of exploitation in 30 days – higher than 3% of CVEs
What to do
AI-suggested
A fix is available in specific GKE versions for Container-Optimized OS: 1.36.5-gke.1817000, 1.35.9-gke.1390000, 1.34.12-gke.1508000, 1.33.13-gke.2152000, 1.32.13-gke.2883000, and 1.31.14-gke.3093000 or later. Users should manually upgrade clusters and node pools even if auto-upgrade is enabled. Ubuntu patch versions are pending and should be applied when available. If patching is not immediately possible, implement mitigations: enforce container image pull integrity using image digest pinning or Binary Authorization to prevent MitM substitution of container images; verify that all external HTTPS webhooks specify an explicit caBundle to avoid fallback to the compromised system root store; for GKE Standard, deploy the privileged Container-Optimized OS CA certificate mitigation DaemonSet to remove compromised roots and restart node daemons in place; rebuild and redeploy customer container workloads with updated base images containing patched root certificates. These mitigations reduce exposure until patches are applied.
Description
Multiple subordinate Certificate Authority private keys from eMudhra (emSign) were compromised, affecting TLS clients and container runtimes that trust these authorities. This vulnerability allows active network Man-in-the-Middle (MitM) interception and traffic spoofing on external TLS connections. Internal GKE cluster mTLS communication remains unaffected due to isolated per-cluster PKI. All currently supported GKE Standard and Autopilot versions running Container-Optimized OS or Ubuntu node images are impacted. Node images and system containers are being updated to distrust the compromised CAs. Customer application containers must be updated independently as they do not inherit the host node's root CA store. Patches are available in specific GKE versions, and mitigations include enforcing image pull integrity, verifying webhook caBundle configurations, applying live-node OS mitigations, and rebuilding container workloads with patched base images.