Published Tue, Jul 18th, 2023


An information disclosure vulnerability in the Google Cloud Build service could have allowed an attacker to view sensitive logs if they had gained prior access to a GCP environment and had permission to create a new Cloud Build instance (cloudbuild.builds.create) or permission to directly impersonate the Cloud Build default service account (which is highly privileged by design and therefore considered to be a known privilege escalation vector in GCP). An attacker could then potentially use this information in order to better facilitate lateral movement, privilege escalation or a supply chain attack by other means. This issue was due to excessive permissions granted to the default service account created by Cloud Build, particularly access to audit logs containing all project permissions (logging.privateLogEntries.list).

Affected Services

Cloud Build


None required

Tracked CVEs

No tracked CVEs


Disclosure Date
Exploitablity Period
Known ITW Exploitation
Detection Methods
Piercing Index Rating
Discovered by
Roi Nisimi, Orca Security