Google Cloud VRP adds $250,000 'Root-in-Cloud' reward for full project or organization takeover

Linha do tempo

1. bleepingcomputer.com ↗ · pub. 03/11/2026 09:05 · coletado 03/11 10:00

   Google Launches $250,000 Cloud VRP Reward for 'Root-in-Cloud' Vulnerabilities

   ler a análise desta fonte ocultar

   Google has introduced a new top-tier reward of $250,000 within its Cloud Vulnerability Reward Program (VRP) for researchers who identify Root-in-Cloud bugs — critical architectural flaws such as tenant-isolation bypasses and cross-service logic errors that grant full administrative control over arbitrary Google Cloud organizations. To qualify, researchers must demonstrate complete IAM/owner-level control without prior access, compromised credentials, social engineering, or user interaction. Reports showing remote code execution in Google's production infrastructure (Borg) may also be automatically evaluated for Root-in-Cloud eligibility. This expansion follows Google's October suspension of its Open Source Software VRP due to a flood of AI-generated low-quality submissions, and comes after a record $17.1 million paid to researchers in 2025.

   Technical Details

   To prevent risk to real customer environments, Google created a deterministic proof-of-root mechanism using a designated service account, allowing researchers to cryptographically prove unauthorized access without touching live customer projects. Researchers who achieve code execution on Google's production infrastructure must immediately stop testing; further escalation, credential theft, or lateral movement results in disqualification. Full technical specifications, including endpoint details, JSON payloads, and CLI examples, are published on Google's Cloud VRP rules page.

   Remediation

   This is a bug bounty program expansion rather than a vulnerability disclosure; no remediation action is required from defenders.

2. gbhackers.com ↗ · pub. 03/11/2026 03:20 · coletado 03/11 04:00

   Google launches $250,000 'Root-in-Cloud' bounty for full Google Cloud project and organization takeover

   ler a análise desta fonte ocultar

   Google announced on October 30 a $250,000 reward tier, called Root-in-Cloud, in its Google Cloud Vulnerability Reward Program. It pays researchers who demonstrate complete administrative takeover of arbitrary Google Cloud projects or organizations with no prior access. The program targets architectural flaws such as tenant isolation bypasses and complex cross-service logic issues. It was described by CISO Chris Betz and VRP lead Michael Cote. This is a bounty program announcement, not an active threat.

   Technical Details

   • A qualifying report must show control equivalent to the roles/owner role, or full IAM control, over arbitrary projects or organizations. It must work without any special configuration of the victim environment.
   • Exploits cannot rely on existing access, prior footholds, leaked or stolen credentials, phishing, social engineering or any user interaction.
   • Researchers must use a designated service account to produce cryptographic proof of unauthorized access, rather than testing against real customer projects.
   • Remote code execution in Google's Borg production infrastructure (root-in-prod) is automatically evaluated for eligibility. Researchers must stop probing immediately after achieving any code execution. Further escalation, production credential extraction and lateral movement are prohibited and can disqualify the report.
   • The article cites the patched ImageRunner (Cloud Run) and ConfusedComposer (Cloud Composer / Cloud Build) issues as examples that fell short of the bar, because both required existing permissions.
   • Cote said valid VRP reports have stayed stable over 18 months while total submissions rose sharply, which he attributes to automation raising triage noise.

   Remediation

   • Cote advises enterprise teams to prepare triage pipelines for agent-generated vulnerability reports and to separate plausible hallucinations from reproducible bugs.
   • Teams should speed up remediation after public disclosure and demand coordinated disclosure from security partners.
3. securityweek.com ↗ · pub. 02/11/2026 10:25 · coletado 02/11 12:00 primeiro registro

   Google Cloud VRP adds $250,000 root-in-cloud reward for full tenant or project takeover

   ler a análise desta fonte ocultar

   Google has expanded its Cloud Vulnerability Reward Program (VRP) with a new top-tier reward of $250,000 for research that achieves full administrative control of Google Cloud. To qualify, a researcher must show roles/owner privileges or complete IAM control over arbitrary Google Cloud organizations or projects. The exploit path must not rely on pre-existing project access, previously compromised credentials, or user interaction and social engineering. Reports demonstrating remote code execution in Borg, Google's production infrastructure, or root-in-production will also be considered. Google frames the reward as recognition of high-impact architectural research, and says AI-assisted (agentic) tooling is helping researchers find more interesting bugs.

   Technical Details

   • Validation is based on Google's analysis of the initial entry point, execution context and attack surface, which must show that full arbitrary tenant or project takeover is possible.
   • Researchers must stop all probing immediately upon achieving any execution in Borg. Escalation, extraction of production credentials and lateral movement are prohibited and lead to disqualification (Google Cloud CISO Chris Betz).
   • Google built a deterministic proof-of-root mechanism around a designated service account, so researchers can cryptographically prove unauthorized access against that identity instead of testing against real customer projects (VRP lead Michael Cote).

   Remediation

   No vulnerability or exploitation is reported, so no defensive action is required. Researchers should follow the published Cloud VRP rules of engagement.