Dialogflow CX CVE-2025-12952
HIGHAttack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessObtain Dialogflow agent developer access with Webhook editor permission
-
ExploitConfigure Webhook using service agent access token auth
-
ExecutionAbuse service-agent token to escalate to project scope
-
ImpactManage/consume resources across associated GCP services
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V8 - Authorization Least privilege enforcement
MITRE ATT&CK
1 technique across 1 tactic: Privilege Escalation The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Requires an authenticated Dialogflow CX agent developer identity that has been granted the Webhook editor permission; the attacker then configures a Webhook to use Dialogflow service agent access token authentication to escalate from agent-level to project-level privileges. Key limiting factors: it is NOT remotely unauthenticated - an existing agent-level trusted/authorized role (PR:L) is a prerequisite, so the realistic threat is a malicious or compromised agent developer (insider/abuse-of-access), not an anonymous internet attacker; additionally, Google applied a server-side fix in February 2025, so current Dialogflow CX deployments are no longer exploitable and no customer configuration change is needed. |
| Impact | This is a privilege-escalation flaw (CWE-269) in Google Cloud's managed Dialogflow CX service. The input CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N, VC:H/VI:H/VA:H) scores 8.7/High: network-reachable, low complexity, no user interaction, but requires low-level privileges - specifically an existing Dialogflow agent developer identity holding the Webhook editor permission. The signals DIVERGE sharply from the raw severity: EPSS is only 0.37% (30th percentile), there is no CISA KEV listing, and no public exploit was identified. Most decisively, Google states the vulnerability was fixed SERVER-SIDE in February 2025 with no customer action required - meaning for current GCP users this is effectively a remediated, non-actionable historical issue rather than a live priority. The high CVSS reflects the genuine impact of escalating from agent-level to full project-level control over associated GCP services (a true scope/authorization-boundary crossing), but real-world exposure today is near zero because the fix is centrally applied by the cloud provider. Note the input's CVSS 4.0 sets subsequent-system metrics (SC/SI/SA) to N, yet the description explicitly says the attacker gains project-level access to OTHER services - this is arguably a subsequent-system/scope impact and the vendor vector may understate that dimension (verify with Google). |
| Exploit ScenarioDerived | An authenticated Dialogflow agent developer who has been granted Webhook editor permission configures a Webhook to authenticate using the Dialogflow service agent's access token. By abusing that service-agent token, the developer escalates from agent-scoped permissions to project-level privileges, letting them manage resources across other GCP services tied to the producer project and drive up costs/resource consumption. No public exploit code was identified, and the flaw was remediated server-side in February 2025. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Oct 14, 2026
Privilege escalation in Google Cloud Dialogflow CX lets an authenticated agent developer who holds the Webhook editor permission configure a webhook that authenticates using the Dialogflow service agent access token, elevating their access from agent scope to project scope and enabling unauthorized management of resources in services bound to the project - with resulting unexpected costs and resource depletion for the producer project. The vulnerability is a CWE-269 improper privilege management flaw; per the CVSS 3.1 vector (PR:L) it requires an existing authenticated agent-level identity and is not remotely unauthenticated, so the realistic threat model is a malicious or compromised agent developer rather than an anonymous internet attacker. Google applied a server-side fix in February 2025 and no customer action is required; no public exploit code has been identified at time of analysis, and EPSS is low at 0.37% (30th percentile).
RemediationAI
No customer action is required: Google applied the corrective fix server-side in February 2025, and the vulnerability is no longer exploitable on current Dialogflow CX deployments - the fix is documented in the Dialogflow release notes at https://docs.cloud.google.com/dialogflow/docs/release-notes#June_12_2025. Organizations that nonetheless want to reduce residual abuse-of-permission risk (the PR:L prerequisite means a malicious or compromised agent developer remains the only realistic actor) should audit and tighten IAM grants that include the Dialogflow Webhook editor capability, removing it from identities that do not strictly need to define webhooks, and review Dialogflow agent and Cloud Audit Logs for unexpected webhook creations, service-agent token usage, or resource provisioning in downstream services; the trade-off is reduced developer autonomy and possible workflow friction for agent teams. Rotating or reviewing any project-level service agent credentials that may have been exposed during a suspected abuse event, and monitoring billing for anomalous service consumption in the producer project, are useful compensating detective controls where privileged Webhook editor access cannot be withdrawn. These measures are supplementary, not substitutes for patching, since the exploitable code path has already been eliminated by Google's server-side change.
Affected ProductsAI
Google Cloud Dialogflow CX, the managed conversational AI service, across all agent configurations where an agent developer holds the Webhook editor permission and can select Dialogflow service agent access token authentication for a webhook - this is a cloud-service-side condition rather than a versioned software release, and no CPE data was provided in the source intelligence. The consuming condition applies to any Google Cloud project hosting Dialogflow CX agents (the 'producer project' referenced in the advisory whose resources could be managed and depleted). Google's Dialogflow release notes entry at https://docs.cloud.google.com/dialogflow/docs/release-notes#June_12_2025 documents the fix. Because remediation was completed server-side in February 2025, there is no residual vulnerable version to enumerate for customers.
Affects your stack
Find out whether the stacks and servers you run are on an affected version.
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Dialogflow CX is Google Cloud's managed conversational-agent platform, and this issue sits in the Webhook configuration surface rather than in customer-deployed code. Webhooks defined by agent developers can be configured to authenticate to a backend using the Dialogflow service agent access token - a credential that, by design, is associated with project-level service identity rather than a single agent. Because the platform permitted an agent developer holding only the Webhook editor role to select that token-based authentication mode, the effective privilege boundary of the Webhook editor role was misconfigured: the developer could cause outbound calls to carry project-level authority, violating least privilege (CWE-269, Improper Privilege Management). The independent assessment rates this CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H - high confidentiality, integrity and availability impact and a Scope change, reflecting the crossing of the agent-to-project trust boundary - but with PR:L, confirming that a pre-existing authenticated agent-level role is a prerequisite. No CPE strings were supplied because Dialogflow CX is a fully managed Google Cloud service rather than a versioned on-premises product; the relevant state is the backend revision deployed by Google, not a customer-installable build.
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/U:Clear
PR:L because the attacker needs an authorized agent developer role with Webhook editor permission; S:C because privileges cross from the Dialogflow agent authorization scope to the broader GCP project and other services.
Primary rating from Vendor (f45cbf4e-4146-4068-b7e1-655ffc2c548c).
CVSS VectorVendor: f45cbf4e-4146-4068-b7e1-655ffc2c548c
DescriptionCVE.org
A privilege escalation vulnerability exists in Google Cloud's Dialogflow CX.
Dialogflow agent developers with Webhook editor permission are able to configure Webhooks using Dialogflow service agent access token authentication. This allows the attacker to escalate their privileges from agent-level to project-level, granting them unauthorized access to manage resources in services associated with the project, leading to unexpected costs and resource depletion for the producer project.
A fix was applied on the server side to protect from this vulnerability in February 2025. No customer action is required.
Executive ViewAI
Google Cloud Dialogflow CX contains a high-severity privilege-escalation issue that could let an authenticated agent developer with Webhook editor rights act beyond agent scope and manage resources across project-bound services, potentially causing unexpected costs and resource depletion. This primarily affects organizations that grant broad Dialogflow CX agent-development or webhook-editing permissions to internal or partner users, turning a compromised or malicious insider into a project-level risk. Leadership should care because the impact is financial and operational rather than anonymous internet exploitation; no public exploit identified at time of analysis, and the vendor has indicated a server-side fix is already in place.
No vendor-released customer patch identified at time of analysis; context indicates Google applied a server-side fix in February 2025 with no customer action required. Interim mitigations: restrict agent developer and Webhook editor permissions to trusted personnel, audit and remove webhooks that authenticate with the Dialogflow service agent access token, enforce least privilege on project-bound services, enable detailed audit logging, and set billing or resource alerts for unexpected changes or costs.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Authentication bypass attacks exploit flaws in the verification mechanisms that control access to systems and applications.
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
GitHub PoC
Exploit-DB