Security researchers at Tenable have uncovered a significant vulnerability in Google Cloud Platform’s Cloud Composer service that could allow attackers to escalate their privileges across multiple GCP services. Dubbed “ConfusedComposer,” this flaw affects the workflow orchestration service based on Apache Airflow.

The vulnerability enables attackers with edit permissions in Cloud Composer to gain unauthorized access to the default Cloud Build service account, which possesses extensive permissions across GCP services including Cloud Build, Cloud Storage, and Artifact Registry.

“ConfusedComposer is important because it exposes how behind-the-scenes interactions between cloud services can be exploited through privilege escalation,” explained Liv Matan, senior security researcher at Tenable. “An attacker only needs permission to update a Cloud Composer environment to gain access to critical GCP services.”

## Attack Mechanism

The exploit requires an attacker to have composer.environments.update permission, which they can leverage to inject malicious Python Package Index (PyPI) packages. Since Cloud Composer allows users to install custom PyPI packages, attackers can execute arbitrary code within associated Cloud Build instances through installation scripts embedded in their malicious packages.

If successfully exploited, attackers could:
– Extract sensitive data
– Disrupt cloud services
– Deploy malicious code in CI/CD pipelines
– Install backdoors for persistent access

## Remediation

Google addressed the vulnerability on April 13, 2025, by changing how PyPI packages are installed. Instead of using the Cloud Build service account, the environment’s service account is now used. This change affects Cloud Composer 2 environments, while Cloud Composer 3 environments were not impacted as they already used the environment’s service account.

## Other Cloud Vulnerabilities

The report also highlighted recent vulnerabilities in other cloud platforms:

– Microsoft Azure had a “Destructive Stored URL Parameter Injection” vulnerability that could cause data loss when exploited by users with privileged access to Azure SQL Server
– Microsoft Entra ID contained a bug in restricted administrative units that could prevent Global Administrators from modifying protected accounts
– AWS EC2 instances have been targeted through Server-Side Request Forgery (SSRF) vulnerabilities to extract sensitive metadata information

These findings underscore the ongoing security challenges in cloud environments, particularly around privilege escalation and service interactions.