Description

An unauthorized user with key vault write access may cause an authorized client to issue arbitrary authenticated Google Cloud KMS API calls under the authorized user's identity, escalating database-level access into cloud key control and defeating client-side encryption.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "4.2",
  "pubDate": "2026-09-03T16:18:24.967Z",
  "pubdate": "2026-09-03T16:18:24.967Z",
  "executiveSummary": "This vulnerability involves an authorization bypass leading to privilege escalation within Google Cloud KMS integrations. The flaw permits an unauthorized actor with Key Vault write access to manipulate client-side cryptographic flows, effectively forcing an authorized client to execute arbitrary, authenticated Google Cloud KMS API calls.\nBy compromising the integrity of the Key Vault configuration, an attacker can hijack the identity and permissions of an authorized client. This results in the unauthorized use of cryptographic keys, effectively defeating client-side encryption mechanisms intended to protect sensitive database content.\nThe risk implication is severe, as it transforms database-level access into full cloud-based key control. Exploitation requires the attacker to possess write access to the Key Vault configuration, after which they can influence the service's interaction with the Google Cloud KMS backend.\nThis vulnerability demonstrates a critical failure in the trust boundary between the local Key Vault configuration and the cloud provider’s identity management, allowing for unintended API call impersonation that bypasses standard access control lists.",
  "technicalDetails": "The root cause of this vulnerability lies in an insecure implementation of the configuration interface within the Key Vault component, which fails to validate the provenance or integrity of the API parameters provided to the client. This allows an unauthorized user with write access to modify the service's interaction parameters with the Google Cloud KMS API.\nThe attack flow begins when an attacker, already possessing write privileges to the Key Vault configuration, injects malicious instructions or modifies existing key references within the vault. When the legitimate, authorized client application initializes or refreshes its cryptographic operations, it retrieves this poisoned configuration. The client, operating under its legitimate identity and established cloud-authenticated session, subsequently executes arbitrary Google Cloud KMS API calls directed by the attacker's parameters.\nBecause the requests originate from the authorized client, they inherit the client's identity and permissions, circumventing Cloud IAM (Identity and Access Management) restrictions that would otherwise block the attacker's direct access to the KMS resources. This results in a 'confused deputy' scenario where the client unknowingly performs operations on behalf of the attacker.\nThe impact of this post-exploitation behavior is the complete compromise of cryptographic operations. The attacker gains the ability to use the authorized client to decrypt sensitive database entries or perform unauthorized cryptographic operations using the keys managed by Google Cloud KMS. By successfully influencing these calls, the attacker defeats client-side encryption layers, as the client can be coerced into providing decrypted payloads or signing data with unauthorized parameters. This essentially provides the attacker with a functional 'proxy' to the Cloud KMS that operates with the full authority of the client application, effectively nullifying the security guarantees provided by the encryption-at-rest architecture."
}