Google Cloud Apigee EUVD-2026-42584

Exploitation requires an authenticated session with high-privilege access to Google Cloud Apigee (PR:H per CVSS vector). The vulnerability is specifically in the BigQuery DAO component, so the attacker must be able to invoke BigQuery-related API management operations within Apigee. High attack complexity (AC:H) indicates that additional conditions must be met - likely specific query construction or knowledge of tenant identifiers - beyond simply being authenticated. Exploitation is limited to Apigee versions prior to June 12, 2026; all current instances are patched. There is no indication that unauthenticated or low-privilege users could trigger this flaw, and no user interaction from a victim is required.

The CVSS 4.0 vector (AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L) yields a score of 5.9 (Medium), but the raw score understates the business impact in a multi-tenant cloud context. Network accessibility (AV:N) is offset by high attack complexity (AC:H) and high privilege requirement (PR:H), narrowing the realistic attacker pool to credentialed, technically sophisticated users. The vendor's SC:L/SI:L/SA:L for subsequent-system impact may understate the confidentiality risk to affected tenants - this analyst independently assesses subsequent-system confidentiality as High (SC:H) since cross-tenant data is directly read. No EPSS score was provided in the input, limiting probabilistic exploitation forecasting. No KEV listing and no POC exist, so there is no evidence of active or opportunistic exploitation. Because Google has already applied the patch server-side, the effective exposure window is closed for all Apigee customers without any action on their part. The primary residual risk is historical: if the vulnerability was exploited before June 12, 2026, affected tenants may not know their data was accessed.

An authenticated attacker with high-privilege access to a Google Cloud Apigee instance - such as a malicious insider, a compromised service account, or a rogue tenant - crafts a specially constructed BigQuery DAO request that exploits the input validation gap to reference another tenant's BigQuery dataset rather than their own. Due to high attack complexity (AC:H), the attacker likely needs knowledge of tenant data layout or must iterate requests to identify accessible cross-tenant resources. No public exploit code has been identified, suggesting exploitation would require targeted effort rather than automated tooling.