I Didn’t Register for This: What’s Really in Google’s Artifact Registry?

The talk starts with a cloud vulnerability researcher who, while examining Google Cloud Composer, found a Kubernetes configuration pulling an image from Artifact Registry. Image tags tied it to Google's organization ID, suggesting Google had published it for production use. A missing list permission blocked browsing the project, but the legacy gcr.io domain exposed more Google-uploaded images.

Scanning the gathered images covered over 3,000 images from 32 repositories, sorted into three groups: third-party marketplace images, Google's base images, and images Google runs in its own production. The results showed about 1.7 million vulnerability findings, roughly 350,000 unique CVEs, and many critical issues, including Log4Shell, Zerologon and Spring4Shell. Nearly 3,000 secrets appeared, all in marketplace images, among them cloud credentials, API keys and hard-coded administrator logins. Google said it had checked the production images but could not judge exploitability for marketplace ones.

The speaker urged users never to assume trust based on the publisher, to scan images for secrets and vulnerabilities, to keep marketplace images patched, and to audit what actually runs in their environments. The talk closes by questioning the shared responsibility model, since marketplace documentation puts vulnerability-free requirements on vendors while the review process involves Google scanning.