GCP Cloud Composer Bug Let Attackers Elevate Access via Malicious PyPI Packages

Summary: Cybersecurity researchers revealed a patched vulnerability in Google Cloud Platform’s Cloud Composer that could allow attackers to escalate privileges and access sensitive services. Known as ConfusedComposer, this flaw permitted users to exploit custom Python packages to gain unauthorized access across GCP. Similar vulnerabilities in other cloud services highlight the broader implications of inherited security issues within interconnected cloud systems.

Affected: Google Cloud Platform (GCP)

Keypoints :

• The vulnerability, dubbed ConfusedComposer, is a privilege escalation flaw in Cloud Composer.
• Attackers with edit permissions could escalate access to the Cloud Build service account, leading to data breaches and service disruption.
• Google has remedied the issue by updating security protocols regarding the service account as of April 13, 2025.