Executive brief
Google Cloud's Developer Connect service, which manages GitLab and Bitbucket integrations, had a permission validation flaw that allowed attackers to access secrets they shouldn't have access to. The vulnerability meant that only the service's own credentials were checked when retrieving secrets, not the requester's permissions. This could allow unauthorized access to sensitive credentials stored in Secret Manager.
Technical details
A privilege escalation vulnerability in Google Cloud Developer Connect allowed improper access to Secret Manager secrets for GitLab Enterprise and Bitbucket Data Center connections. The root cause was insufficient permission validation: the service only checked permissions for the Developer Connect service agent (P4SA) credentials when retrieving secrets, but failed to validate that the calling principal also had the required permissions. The vulnerability required network access to Developer Connect APIs. The fix implemented dual permission validation, requiring both the calling principal and the P4SA to possess the necessary Secret Manager permissions before allowing secret retrieval.
Affected products
- Google Cloud Developer Connect
Timeline
- 2026-07-13: disclosed