Stay organized with collectionsSave and categorize content based on your preferences.
Upgrading a cluster to the latest Google Distributed Cloud version brings added
features and fixes to your cluster. With each patch release, we fix numerous
security vulnerabilities which makes upgrading to the latestrecommended patch
versionall the more important. Upgrading is a shared responsibility between Google and
the customer. For more information about shared responsibilities, seeShared
Responsibility Model
This page is for Security specialists who support the resolution of security
issues or vulnerabilities which need strategic assistance, such as incidents and
issues escalated from support. To learn more about common roles and example
tasks that we reference in Google Cloud content, seeCommon
GKE user roles and tasks.
How vulnerabilities are classified
Security vulnerabilities are usually identified through theCommon
Vulnerabilities and Exposures (CVE)system. The
GKE security team classifies vulnerabilities according
to theKubernetes vulnerability
scoringsystem. Classifications consider many factors including GKE and
Google Distributed Cloud configuration and security hardening. Because of these
factors and the investments Google Cloud makes in security, these vulnerability
classifications might differ from other classification sources.
The following table describes vulnerability severity categories:
Severity
Description
Critical
A vulnerability easily exploitable inallclusters by an
unauthenticated remote attacker that leads to full system compromise.
High
A vulnerability easily exploitable formanyclusters that leads to
loss of confidentiality, integrity, or availability.
Medium
A vulnerability exploitable forsomeclusters where loss of
confidentiality, integrity, or availability is limited by common
configurations, difficulty of the exploit itself, required access, or user
interaction.
Low
All other container vulnerabilities. Exploitation is unlikely or consequences of
exploitation are limited.
Security bulletins
Most vulnerabilities are fixed in supported versions of Google Distributed Cloud
before they can be exploited. When there are reported incidents that have the
potential to compromise the security of your clusters and data, we publish
security bulletins. A security bulletin describes the security issue and its
impact and provides a mitigation. For more information and a list of published
bulletins, see theSecurity
bulletinspage.
When a security bulletin is published for a vulnerability that affects
Google Distributed Cloud (software only) on VMware, we publish a corresponding
release note with a link to the bulletin.
Fixed vulnerabilities by Google Distributed Cloud patch version
The following table lists all vulnerabilities that have been fixed, starting in
January 2025. For older fixes, see therelease
notes. The fixes in the following table are listed
by Google Distributed Cloud release version and severity:
[[["Easy to understand","easyToUnderstand","thumb-up"],["Solved my problem","solvedMyProblem","thumb-up"],["Other","otherUp","thumb-up"]],[["Hard to understand","hardToUnderstand","thumb-down"],["Incorrect information or sample code","incorrectInformationOrSampleCode","thumb-down"],["Missing the information/samples I need","missingTheInformationSamplesINeed","thumb-down"],["Other","otherDown","thumb-down"]],["Last updated 2025-09-04 UTC."],[],[],null,[]]
