Duping Cloud Functions: An emerging serverless attack vector
Summary: Tenable Research found that GCP's Cloud Functions deployment process attached a default Cloud Build service account with excessive permissions, letting anyone able to create or update a function escalate privileges to that account or assign a higher-privileged one. Google partially patched the issue, and Cisco Talos then adapted the technique to run malicious commands through the NPM package.json file, confirming token exfiltration no longer works on GCP but showing similar enumeration behavior in AWS Lambda and Azure Functions.
What you should know: Talos showed the same package.json trick works against AWS Lambda and Azure Functions, so the exposure is not a GCP-only problem - and the enumeration it enables (container detection, mount points, /etc/shadow) is the groundwork for privilege escalation and container escape.
Read the original at Cisco Talos ↗
- Topics
- Cloud Security
- Related
- Google Cloud Warns Three AMD Turin CPU Flaws Could Leak Data Across Processes in VMs Cyber Risks · Nov 12, 2026New Falcon Cloud Security Innovations Secure the Cloud AI Runs On Cyber Risks · Nov 04, 2026