Is there a patch available for CVE-2026-12879?

Yes, a patch is available for CVE-2026-12879. Update the affected software to the latest version immediately.

Google Cloud Apigee CVE-2026-12879

Q: What is the CVSS score of CVE-2026-12879?

CVE-2026-12879 has a CVSS 4.0 base score of 5.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. EPSS exploitation probability: 0.2%.

EUVD-2026-42584 MEDIUM

Externally Controlled Reference to a Resource in Another Sphere (CWE-610)

2026-07-09 GoogleCloud

GHSA-974p-4xqx-2m2q

Information Disclosure Google Apigee

5.9

CVSS 4.0 · Vendor: GoogleCloud

Severity by source

Vendor (GoogleCloud) PRIMARY

5.9 MEDIUM

CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

vuln.today AI

5.8 MEDIUM

Network vector with high complexity and high privileges; scope changes because cross-tenant confidentiality breach affects resources outside the attacker's own tenant.

3.1 AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

4.0 AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:H/SI:N/SA:N

Primary rating from Vendor (GoogleCloud).

CVSS VectorVendor: GoogleCloud

Attack Vector

Network

Attack Complexity

High

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 09, 2026 - 15:01 EUVD

Analysis Generated

Jul 09, 2026 - 13:57 vuln.today

DescriptionCVE.org

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data.

This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.

AnalysisAI

Cross-tenant data exfiltration in Google Cloud Apigee (versions prior to 2026-06-12) is possible via improper input validation in the BigQuery Data Access Object (DAO) component. An authenticated attacker with high-privilege access can craft requests that bypass tenant isolation boundaries, accessing confidential data belonging to other Apigee tenants on Google Cloud Platform. Google patched this server-side on June 12, 2026 with no customer action required; no public exploit or CISA KEV listing has been identified at time of analysis.

Technical ContextAI

Google Cloud Apigee is a multi-tenant API management platform on Google Cloud Platform; its BigQuery DAO component handles data access to Google BigQuery for analytics and logging purposes. CWE-610 (Externally Controlled Reference to a Resource in Another Sphere) is the root cause: user-supplied input is not sufficiently validated before being used to construct or direct resource references, allowing the request to resolve to a resource (another tenant's BigQuery data) outside the intended authorization boundary. In a multi-tenant SaaS architecture this class of flaw is particularly severe because the blast radius crosses organizational trust boundaries - what appears to be a medium-severity CVSS score conceals a high-impact business consequence (unauthorized access to another customer's data). CPE cpe:2.3:a:google_cloud:apigee:*:*:*:*:*:*:*:* covers all Apigee versions up to the June 12, 2026 patch.

RemediationAI

No customer action is required. Google patched the vulnerability directly on Apigee infrastructure on June 12, 2026; all Apigee customers on Google Cloud Platform are automatically protected as of that date. Organizations that want to verify current patch status or review the release notes should consult the official Apigee release notes at https://cloud.google.com/apigee/docs/release-notes#July_08_2026. For incident response purposes, organizations with sensitive data processed through Apigee prior to June 12, 2026 should review audit logs for anomalous BigQuery DAO queries or unexpected cross-tenant data access patterns, particularly from privileged accounts, to assess whether the vulnerability may have been exploited before patching.