EUVD-2026-70996
GHSA-vwm5-6ggm-73px
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Network-reachable GCP API, low complexity, authenticated low-privilege user required; scope changes to full Google Cloud Project giving C:H/I:H/A:H on subsequent systems.
Primary rating from Vendor (GoogleCloud).
CVSS VectorVendor: GoogleCloud
Lifecycle Timeline
6DescriptionCVE.org
A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment.
This vulnerability was patched on 11 December 2025, and no customer action is needed.
AnalysisAI
Privilege escalation in Google Cloud Integration Connectors (HTTP Connector component) allows an authenticated low-privilege user to attach an unauthorized service account to a connector, effectively taking over the associated Google Cloud Project. Affected versions are those deployed prior to the 2025-12-11 server-side patch, which Google applied automatically with no customer action required. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires a valid GCP identity with at minimum low-level authenticated access to the target Google Cloud Project - no anonymous or unauthenticated exploitation is possible. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) scores 8.5 and accurately reflects the network-reachable attack surface with low attack complexity and no required user interaction, though authentication as a low-privilege user (PR:L) is a necessary prerequisite. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Google has fully remediated this vulnerability server-side as of 2025-12-11; no customer action is required. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, audit the audit logs and access history of all Google Cloud Integration Connectors deployed before 2025-12-11 to identify any unauthorized service account attachment activity. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-863 – Incorrect Authorization
View allShare
External POC / Exploit Code
Leaving vuln.today