GCP-2026-017

<p><strong>Published: </strong>2026-04-02<br/> <strong>Reference:</strong> <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2026-23273">CVE-2026-23273</a></p><devsite-selector> <section> <h3 data-text="GKE" id="gcp-2026-017-gke" tabindex="-1">GKE</h3> <table> <thead> <tr> <th>Description</th> <th>Severity</th> </tr> </thead> <tbody> <tr> <td> <p>The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: </p><ul> <li>CVE-2026-23273</li> </ul> <p>GKE Standard clusters are impacted. GKE Autopilot clusters in the default configuration are not impacted, but might be vulnerable if you explicitly set the seccomp <code dir="ltr" translate="no">Unconfined</code> profile or allow <a href="https://docs.cloud.google.com/sdk/gcloud/reference/container/clusters/create-auto#--workload-policies"><code dir="ltr" translate="no">CAP_NET_ADMIN</code></a>.</p> <p>Clusters using <a href="https://docs.cloud.google.com/kubernetes-engine/docs/concepts/sandbox-pods">GKE Sandbox</a> aren't impacted.</p> <h4 data-text="What should I do?" id="what-should-i-do_51" tabindex="-1">What should I do?</h4> <p>The following minor versions are affected. <a href="https://docs.cloud.google.com/kubernetes-engine/docs/how-to/upgrading-a-container-cluster">Upgrade</a> your Container-Optimized OS node pools to one of the following patch versions or later:</p> <ul> <li>1.35.2-gke.1485000</li><li>1.34.5-gke.1153000</li><li>1.33.9-gke.1060000</li> </ul> <p>You can apply patch versions from newer release channels if your cluster runs the same minor version in its own release channel. This feature lets you secure your nodes until the patch version becomes the default in your release channel. For details, see <a href="https://docs.cloud.google.com/kubernetes-engine/docs/concepts/release-channels#newer-patch-versions">Run patch versions from a newer channel</a>.</p> </td> <td>High</td> </tr> </tbody> </table> </section> <section> <h3 data-text="GDC (VMware)" id="gcp-2026-017-gdcvmware" tabindex="-1">GDC (VMware)</h3> <table> <thead> <tr> <th>Description</th> <th>Severity</th> </tr> </thead> <tbody> <tr> <td> <p>The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: </p><ul> <li>CVE-2026-23273</li> </ul> <h4 data-text="What should I do?" id="what-should-i-do_52" tabindex="-1">What should I do?</h4> <p><aside class="note"><strong>Note: </strong>Patch versions and a severity assessment for GDC software for VMware are in progress. We'll update this bulletin with that information when it's available.</aside></p> </td> <td>Pending</td> </tr> </tbody> </table> </section> <section> <h3 data-text="GKE on AWS" id="gcp-2026-017-gkeaws" tabindex="-1">GKE on AWS</h3> <table> <thead> <tr> <th>Description</th> <th>Severity</th> </tr> </thead> <tbody> <tr> <td> <p>The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: </p><ul> <li>CVE-2026-23273</li> </ul> <h4 data-text="What should I do?" id="what-should-i-do_53" tabindex="-1">What should I do?</h4> <p><aside class="note"><strong>Note: </strong>Patch versions and a severity assessment for GKE on AWS are in progress. We'll update this bulletin with that information when it's available.</aside></p> </td> <td>Pending</td> </tr> </tbody> </table> </section> <section> <h3 data-text="GKE on Azure" id="gcp-2026-017-gkeazure" tabindex="-1">GKE on Azure</h3> <table> <thead> <tr> <th>Description</th> <th>Severity</th> </tr> </thead> <tbody> <tr> <td> <p>The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: </p><ul> <li>CVE-2026-23273</li> </ul> <h4 data-text="What should I do?" id="what-should-i-do_54" tabindex="-1">What should I do?</h4> <p><aside class="note"><strong>Note: </strong>Patch versions and a severity assessment for GKE on Azure are in progress. We'll update this bulletin with that information when it's available.</aside></p> </td> <td>Pending</td> </tr> </tbody> </table> </section> <section> <h3 data-text="GDC (bare metal)" id="gcp-2026-017-gdcbm" tabindex="-1">GDC (bare metal)</h3> <table> <thead> <tr> <th>Description</th> <th>Severity</th> </tr> </thead> <tbody> <tr> <td> <p>The following vulnerabilities were discovered in the Linux kernel that can lead to a privilege escalation on Container-Optimized OS nodes: </p><ul> <li>CVE-2026-23273</li> </ul> <h4 data-text="What should I do?" id="what-should-i-do_55" tabindex="-1">What should I do?</h4> <p>There is no action required. GDC software for bare metal isn't affected as it does not bundle an operating system in its distribution.</p> </td> <td>None</td> </tr> </tbody> </table> </section> </devsite-selector>