Which versions of Google BigQuery are affected by CVE-2026-14934?

Cross-tenant privilege escalation in Google Cloud BigQuery, Dataform, and Colab Enterprise (CVE-2026-14934) allowed users to escalate privileges and access repositories belonging to other…. A patch is available.

How to fix or mitigate CVE-2026-14934?

Within 24 hours: verify that BigQuery, Dataform, and Colab Enterprise services are operating at the current version incorporating the 10 May 2026 server-side remediation and scan recent repository access logs for indicators of cross-tenant activity. Within 7 days: retrieve and analyze Cloud Audit Logs from October 2025 through May 2026 focusing on repository creation, modification, and access events to identify any unauthorized cross-tenant access. Within 30 days: document findings from the audit analysis, implement additional IAM tenant-isolation policies to prevent future cross-tenant privilege escalation, enable continuous monitoring of repository access with automated alerting for anomalies, and establish quarterly security reviews of managed service configurations.

Google BigQuery CVE-2026-14934

Q: What is the CVSS score of CVE-2026-14934?

CVE-2026-14934 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. EPSS exploitation probability: 0.2%.

EUVD-2026-43338 CRITICAL

Missing Authorization (CWE-862)

2026-07-13 GoogleCloud

Authentication Bypass Google Bigquery Dataform Colab Enterprise Google Cloud

9.4

CVSS 4.0 · Vendor: GoogleCloud

Severity by source

Vendor (GoogleCloud) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

vuln.today AI

9.9 CRITICAL

Network API reachable with low-privilege auth and no interaction (AV:N/AC:L/PR:L/UI:N); cross-tenant impact crosses a security boundary so S:C with full C/I/A loss.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (GoogleCloud).

CVSS VectorVendor: GoogleCloud

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jul 13, 2026 - 12:01 EUVD

Analysis Generated

Jul 13, 2026 - 11:16 vuln.today

CVE Published

Jul 13, 2026 - 10:20 cve.org

CRITICAL 9.4

DescriptionCVE.org

A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover.

This vulnerability was patched on 10 May 2026, and no customer action is needed.

AnalysisAI

Cross-tenant privilege escalation in the repository creation functionality shared by Google Cloud BigQuery, Dataform, and Colab Enterprise allowed an authenticated GCP user to take over repositories belonging to other tenants. Rated CVSS 4.0 9.4 (critical) with a scope-changing cross-tenant impact, the flaw was a Missing Authorization (CWE-862) issue affecting the managed services between October 2025 and 10 May 2026. Google reports no public exploit identified at time of analysis; the defect was fixed server-side on 10 May 2026 with no customer action required.

Technical ContextAI

The affected components are Google Cloud's managed analytics and data-engineering services: BigQuery (cpe:2.3:a:google_cloud:bigquery), Dataform (cpe:2.3:a:google_cloud:dataform), and Colab Enterprise (cpe:2.3:a:google_cloud:colab_enterprise). Dataform provides Git-style repositories for managing SQL and data-pipeline code, and these repositories are surfaced and consumable across BigQuery and Colab Enterprise. The root cause is CWE-862 Missing Authorization: the repository creation code path failed to enforce a tenant/ownership boundary check, so an operation that should have been constrained to the caller's own project or tenant could instead act on or claim repositories in another tenant. Because this is a multi-tenant cloud control-plane API rather than on-prem software, the authorization gap directly translates into a cross-tenant isolation break.

RemediationAI

No customer action is required: Google remediated the vulnerability server-side across BigQuery, Dataform, and Colab Enterprise on 10 May 2026, so all customers are automatically protected as of that date (patch available per vendor advisory and applied by Google - see https://docs.cloud.google.com/support/bulletins#gcp-2026-047). There is no package to upgrade because these are fully managed services. As good hygiene following any cross-tenant control-plane issue, customers who created or modified Dataform repositories during the October 2025 to 10 May 2026 window should review repository ownership and IAM bindings for unexpected principals, audit Cloud Audit Logs for anomalous repository-creation or takeover activity, and confirm least-privilege on BigQuery, Dataform, and Colab roles; these detective reviews have no functional side effects.