🟠 High | Source: GCP Compute Engine Security Bulletins
A Linux kernel vulnerability, CVE-2026-23268 (dubbed ‘CrackArmor’), affects the AppArmor security module and can be exploited to achieve privilege escalation on Google Cloud’s Container-Optimized OS (COS) nodes. This is particularly relevant for workloads running on GKE, Dataflow, or Cloud SQL that rely on COS as their underlying node OS. Unpatched nodes could allow an attacker to escalate privileges within containerised environments, potentially breaking out of intended security boundaries.
Security Architect’s Take: Immediately identify all COS node pools and standalone COS VMs in your environment and upgrade to image version cos-125-19216-220-57; for GKE and other managed services, trigger node pool upgrades promptly and verify that milestones 117 and 121 receive the in-progress fixes before considering those tracks safe.
Original advisory: GCP-2026-015