EUVD-2026-66420
GHSA-crp5-85j7-whg7
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to tenant with low privileges
-
DeliveryCreate/edit BigQuery data transfer config
-
ExploitInject crafted JDBC connection-string parameters
-
ExecutionDriver executes code in connector container
-
ImpactEscalate privileges in tenant project
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V1 - Encoding and Sanitization Input neutralization, injection prevention
|
| Exploitation Conditions | Exploitation requires an authenticated principal (CVSS PR:L) with the ability to define or modify a BigQuery Data Transfer Service transfer that uses the CData JDBC driver integration, and to control the JDBC connection string parameters for that transfer - the crafted connection-string parameters are the exact injection vector. No user interaction is required (UI:N) and the vector is network-reachable (AV:N/AC:L). The key limiting factor is that only pre-2026-05-01 service versions were vulnerable and Google patched all tenants on that date, so exploitation was only possible before the fix and only for principals authorized to configure JDBC-based transfers within a tenant. |
| Impact | The signals are internally consistent and point to a genuinely high-severity issue in principle: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low-privilege authentication and no user interaction, with high confidentiality/integrity/availability impact on both the vulnerable system (VC/VI/VA:H) and subsequent systems (SC/SI/SA:H) - the subsequent-system impact reflects the described privilege escalation from the connector container into the tenant project. However, real-world attacker priority is largely moot: this is a cloud-managed service that Google patched globally on 2026-05-01 with no customer action required, so no unpatched instances remain in customer control. There is no EPSS score provided, no POC, and no KEV listing, so there is no evidence of active or automated exploitation - the high score reflects potential impact, not observed weaponization. Sourcing is limited to a single Google Cloud bulletin reference; independent corroboration of exploitability is not available. |
| Exploit ScenarioDerived | An attacker who already holds low-privilege access to a Google Cloud tenant creates or edits a BigQuery data transfer configuration and embeds malicious directives in the JDBC connection string parameters passed to the CData driver. When the transfer runs, the crafted parameters are interpreted by the driver, executing attacker code inside the connector container and providing a foothold to escalate privileges within the tenant project. No public exploit code is identified at time of analysis. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Aug 26, 2026
Remote code execution in Google Cloud BigQuery Data Transfer Service (versions prior to the 2026-05-01 service release) allows an authenticated tenant user to run arbitrary code inside the managed connector container and escalate privileges within the tenant project by supplying crafted parameters in a JDBC connection string routed through the bundled CData JDBC driver. Rated CVSS 4.0 9.4 (Critical) with a scope change to subsequent systems, the flaw was fixed server-side by Google on 1 May 2026 and requires no customer action. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
RemediationAI
No customer action is required: Google remediated the service globally on 1 May 2026, so all tenants are automatically running the fixed version - this is the primary and complete fix, per Google's bulletin at https://docs.cloud.google.com/support/bulletins#gcp-2026-056 (GCP-2026-056). Patch status: Patch available per vendor advisory (fixed in the 2026-05-01 service release; no discrete customer-installable version number applies to a managed service). As defense-in-depth for the connector pattern generally, operators can apply least-privilege IAM to the service accounts used by data transfers and restrict who can create or modify transfer configurations and their JDBC connection parameters, which limits which principals could supply crafted connection strings; the trade-off is added administrative overhead for teams that legitimately manage many transfers.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The vulnerability lives in BigQuery Data Transfer Service's integration with the CData JDBC driver, the component that connects the managed transfer pipeline to external JDBC-compatible data sources. JDBC connection strings are semi-structured parameter lists (host, database, and driver-specific options such as class-loading, plugin, or script-evaluation properties); when those parameters are not strictly validated, an attacker-controlled connection string can inject directives the driver interprets rather than treats as data. This maps to CWE-74 (Improper Neutralization of Special Elements / Injection): user-supplied input crosses into a control plane (driver configuration) and is executed. The affected product is identified by CPE cpe:2.3:a:google_cloud:bigquery_data_transfer_service, a fully Google-managed multi-tenant service, so the vulnerable code ran inside Google's connector containers rather than on any customer-managed host.
Know when Bigquery Data Transfer Service gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear
Network-reachable, low-privilege authenticated config access (PR:L) with no user interaction; RCE plus escalation out of the container into the tenant project justifies scope change (S:C) and high C/I/A.
Primary rating from Vendor (GoogleCloud).
CVSS VectorVendor: GoogleCloud
Lifecycle Timeline
2DescriptionCVE.org
An Improper Input Validation vulnerability in CData JDBC driver integration in Google Cloud BigQuery Data Transfer Service versions prior to 2026-05-01 on Google Cloud Platform allows an authenticated attacker to achieve remote code execution in the connector container and escalate privileges in the tenant project using crafted JDBC connection string parameters.
This vulnerability was patched on 1 May 2026, and no customer action is needed.
Executive ViewAI
Google Cloud BigQuery Data Transfer Service was vulnerable to authenticated remote code execution through a JDBC connection parameter injection flaw in the CData driver bundle. Google deployed a server-side fix on May 1, 2026, automatically protecting all customers using this service; organizations using BigQuery Data Transfer Service have been protected for over four months with no action required.
Service patched server-side by Google (May 1, 2026); no customer patch required.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB