EUVD-2026-66420
GHSA-crp5-85j7-whg7
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Network-reachable, low-privilege authenticated config access (PR:L) with no user interaction; RCE plus escalation out of the container into the tenant project justifies scope change (S:C) and high C/I/A.
Primary rating from Vendor (GoogleCloud).
CVSS VectorVendor: GoogleCloud
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Lifecycle Timeline
3DescriptionCVE.org
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters.
This vulnerability was patched on 1 May 2026, and no customer action is needed.
AnalysisAI
Remote code execution in Google Cloud BigQuery Data Transfer Service (versions prior to the 2026-05-01 service release) allows an authenticated tenant user to run arbitrary code inside the managed connector container and escalate privileges within the tenant project by supplying crafted parameters in a JDBC connection string routed through the bundled CData JDBC driver. Rated CVSS 4.0 9.4 (Critical) with a scope change to subsequent systems, the flaw was fixed server-side by Google on 1 May 2026 and requires no customer action. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires an authenticated principal (CVSS PR:L) with the ability to define or modify a BigQuery Data Transfer Service transfer that uses the CData JDBC driver integration, and to control the JDBC connection string parameters for that transfer - the crafted connection-string parameters are the exact injection vector. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The signals are internally consistent and point to a genuinely high-severity issue in principle: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low-privilege authentication and no user interaction, with high confidentiality/integrity/availability impact on both the vulnerable system (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H) - the subsequent-system impact reflects the described privilege escalation from the connector container into the tenant project. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | No customer action is required: Google remediated the service globally on 1 May 2026, so all tenants are automatically running the fixed version - this is the primary and complete fix, per Google's bulletin at https://docs.cloud.google.com/support/bulletins#gcp-2026-056 (GCP-2026-056). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours: confirm your organization's current Google Cloud BigQuery Data Transfer Service version is post-May 1, 2026 (service automatically updated). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Share
External POC / Exploit Code
Leaving vuln.today