https://seclists.org/oss-sec/2026/q4/134: Unpatched cross-namespace sect exfiltration in GoogleCloudPlatform/k8s-config-connector - CVE quested (CAN-2026-2039460)
Published Oct 12, 2026
·Updated
Affected Software
1 affected component
Google Cloud k8s-config-connector
Frequently Asked Questions
1
Which parts of the project should be considered potentially affected?
The disclosure identifies Direct controller implementations that resolve Secret references through apis/refs/v1beta1/secret/interface.go, specifically the NormalizedSecret() function. The issue was independently reconfirmed in the master branch on 2026-10-11.
2
What attacker-controlled input is involved?
A custom resource's SecretRef can supply a namespace. NormalizedSecret() uses that supplied namespace when fetching the Secret, and only uses the custom resource's own namespace when the supplied namespace is empty.
3
Is there a vendor fix or assigned CVE available?
No substantive vendor response or fix is described, and the issue was reported as still present in master. The requested identifier, CAN-2026-2039460, was pending assignment at the time of disclosure.