src_d11443da85ea659d49
- Source-provided label
- Not reported
- Evidence class
- mentioned in report
- Confidence
- Not reported
- Observed
- Apr 01, 2025 00:00 UTC
- Retrieved
- Oct 08, 2026 03:52 UTC
ImageRunner: Privilege Escalation Vulnerability in GCP Cloud Run
An attacker with `run.services.update` and `iam.serviceAccounts.actAs` permissions but without explicit registry access could deploy new revisions of Cloud Run services that pulled private container images stored in the same GCP project. This was possible because Cloud Run uses a service agent with the necessary registry read permissions to retrieve these images, regardless of the caller’s access
Reference details
- Source category
- Research & news
- Report title
ImageRunner: Privilege Escalation Vulnerability in GCP Cloud Run- First reported
- Apr 01, 2025 00:00 UTC
- Last reported
- Apr 01, 2025 00:00 UTC
- Catalog updated
- Oct 08, 2026 03:52 UTC
- Record ID
eb21177d82f7a4773be62d4db4a340a6fec4bea6d3fe73fb5b4b8af4759d40c0
Published indicators
Network indicators are visibly defanged. This page does not make them clickable or send them to another service.
No validated file hashes or network indicators are stored for this record.
Source observations
This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.
Feed collection status
Sources represented on this page. Publication and observation dates describe the content; successful batch dates describe local collection. A recent batch does not certify complete coverage or current provider availability.
1 sources: 0 stale, 0 needing attention, 0 paused, 1 unverified.
Review source update dates and status
- src_d11443da85ea659d49Collection status unverifiedLast successful batch: Unverified
Stale means older than twice the recorded collection interval, with a minimum of one hour; without an interval, the threshold is 24 hours. Cached content remains available while a feed is stale, paused, or unverified.