EUVD-2026-68433
GHSA-q4ww-hvh7-426w
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Network-reachable via GitHub with low attacker privilege (PR:L) and required maintainer/user involvement (UI:R); build-environment code execution changes scope (S:C) with full C/I/A impact.
Primary rating from Vendor (GoogleCloud).
CVSS VectorVendor: GoogleCloud
Lifecycle Timeline
3DescriptionCVE.org
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression.
This vulnerability was patched on 24 June 2026, and no customer action is needed.
AnalysisAI
Unreviewed code execution in Google Cloud Build (GitHub-triggered builds prior to the 2026-06-24 fix) allowed a remote attacker to bypass the GitHub Trigger Comment Control approval gate via webhook suppression and run attacker-supplied code inside the build environment. The Comment Control feature is meant to require a maintainer's approval comment before a pull request from an outside contributor triggers a build; the flaw let that check be evaded so unapproved code executed. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a Google Cloud Build GitHub trigger that is configured with Trigger Comment Control (the approval-comment gate for external-contributor pull requests) prior to the 2026-06-24 fix; the attacker must be able to submit a pull request or webhook event to that repository (PR:L - some GitHub-side standing, not fully anonymous) and apply the 'webhook suppression' technique to bypass the approval requirement. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuinely high-severity issue: the vendor CVSS 4.0 score is 9.4 with a network vector (AV:N), low attack complexity (AC:L), only low privileges required (PR:L), and high impact to confidentiality, integrity and availability of both the vulnerable and subsequent systems (VC/VI/VA:H, SC/SI/SA:H), reflecting that code execution in a CI build environment typically yields access to the build service account, source, and secrets. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Patch available per vendor advisory: Google states the vulnerability was patched on 2026-06-24 server-side and that no customer action is needed, so no upgrade or configuration change is required to remediate the core flaw. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today