Is there a patch available for CVE-2026-8934?

Yes, a patch is available for CVE-2026-8934. Update the affected software to the latest version immediately.

Cloud Console CVE-2026-8934

Q: What is the CVSS score of CVE-2026-8934?

CVE-2026-8934 has a CVSS 4.0 base score of 6.9 (Medium). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear. EPSS exploitation probability: 0.4%.

EUVD-2026-38262 MEDIUM

Missing Authorization (CWE-862)

2026-06-22 GoogleCloud

GHSA-5xr4-qrm5-m2w8

Authentication Bypass Google Cloud Console Uis Google Cloud

6.9

CVSS 4.0 · Vendor: GoogleCloud

Severity by source

Vendor (GoogleCloud) PRIMARY

6.9 MEDIUM

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear

vuln.today AI

5.8 MEDIUM

Scope changed (S:C) because the attacker reads log data from other GCP projects outside the exploited component's authorization boundary; PR:N confirmed by CVSS 4.0 input.

3.1 AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Primary rating from Vendor (GoogleCloud).

CVSS VectorVendor: GoogleCloud

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Patch available

Jun 22, 2026 - 17:01 EUVD

Analysis Generated

Jun 22, 2026 - 16:08 vuln.today

DescriptionCVE.org

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request.

This vulnerability was patched on 7 April 2026, and no customer action is needed.

AnalysisAI

Cross-project App Engine request log leakage in Google Cloud Console's GraphQL private API exposed sensitive telemetry data to unauthenticated remote attackers. The vulnerability, classified as CWE-862 (Missing Authorization), allowed a specially crafted GraphQL request to bypass authorization controls on the App Engine section of Cloud Console, enabling read access to request logs belonging to arbitrary GCP projects. Google applied a server-side fix on 7 April 2026; no public exploit or KEV listing has been identified at time of analysis.

Technical ContextAI

The vulnerability resides in the GraphQL private API layer of Google Cloud Console (CPE: cpe:2.3:a:google_cloud:cloud_console_uis:*:*:*:*:*:*:*:*), specifically the App Engine management interface. CWE-862 (Missing Authorization) indicates that the GraphQL operation lacked a proper authorization check before serving log data, meaning the API failed to verify whether the requesting caller had entitlement to the requested project's logs. GraphQL APIs can expose multiple operations under a single endpoint; a missing per-operation authorization gate - distinct from transport-level authentication - is a common misconfiguration in GraphQL deployments. The 'private API' designation suggests this endpoint was intended for internal Cloud Console UI use, but was reachable by external actors, widening the attack surface beyond intended design.

RemediationAI

No customer action is required. Google applied a server-side fix to all Cloud Console infrastructure on 7 April 2026, eliminating the missing authorization gate in the GraphQL private API. Because Cloud Console is a fully managed SaaS platform, customers do not manage or patch the underlying UI service. Organizations that require assurance should review their App Engine request logs for unexpected cross-project access activity prior to 7 April 2026 as a precautionary measure, particularly if they operate projects with sensitive application-level log data. The official advisory is published at https://docs.cloud.google.com/support/bulletins#gcp-2026-038.