https://seclists.org/oss-sec/2026/q4/133: Unpatched cdential leak in kubernetes/cloud-provider-gcp (auth-provider-gcp) - CVE quested (CAN-2026-2039459)
Published Oct 12, 2026
·Updated
Affected Software
1 affected component
Kubernetes cloud-provider-gcp
Frequently Asked Questions
1
Which systems are exposed to the logging behavior?
The affected code is in the auth-provider-gcp kubelet credential provider plugin. The disclosure states that this plugin is deployed on every GKE node and is invoked on each image pull from GCR or Artifact Registry.
2
What event causes the metadata response to be written to logs?
Logging occurs when ContainerRegistryProvider.Provide() cannot parse the GCE metadata server token response as JSON. In that error path, the raw response body is passed to klog.Errorf.
3
Is a fix or final CVE identifier available?
The issue was independently reconfirmed as present in the master branch on 2026-10-11. A CVE was requested under CAN-2026-2039459, but it was still pending assignment in the disclosure.