Description

A publicly accessible Compute Engine instance has one or more vulnerabilities and assumes a service account that can escalate its privileges to another service account with administrator access. An attacker who exploits a vulnerability to compromise the instance from the internet can use the attached service account’s credentials to escalate privileges and gain administrative control over the GCP project.

Remediation

1. Review any associated vulnerability references or advisories, and apply the appropriate patch. If no patch is available, apply compensating controls such as disabling or removing the vulnerable component.
2. Assess whether this instance needs to be accessible from the internet. If not, restrict access by updating firewall rules to only allow traffic from trusted sources. See VPC firewall rules for guidance.
3. Review and restrict the service account’s IAM permissions to remove privilege-escalation paths (e.g. roles/iam.serviceAccountTokenCreator, iam.serviceAccounts.actAs, and related bindings). See Understanding roles for applying least privilege.