Application Integration
Monthly
Arbitrary code execution in Google Cloud Application Integration affects service versions prior to 2026-09-11: an authenticated attacker (CVSS PR:L) can supply a maliciously crafted serialized object to the SubWorkflow task and execute arbitrary code. The issue carries a supplied CVSS score of 9.4 and the priority signal is act_now, but Google reports the defect was fixed server-side on 11 September 2026 with no customer action required. No public exploit is identified at time of analysis, and no CISA KEV entry is present in the supplied data.
Privilege escalation in Google Cloud Application Integration (versions prior to 2026-08-27) allows an authenticated low-privilege user within a Google Cloud project to abuse AuthConfig validation and the integration execution runtime to impersonate a higher-privileged service account and gain that account's cloud permissions. The flaw is classified as Incorrect Authorization (CWE-863) with a CVSS v4.0 base score of 7.3; there is no public exploit identified at time of analysis and no CISA KEV listing. Google remediated the issue server-side on 27 August 2026, so current Google Cloud instances are no longer affected and no customer patching action is required.
Authenticated Google Cloud users holding permission to configure Application Integration tasks could abuse an incorrectly authorized, internal-only task type to trigger arbitrary internal RPCs that executed inside Google's production network under a privileged Google identity. The flaw (CWE-863) affected Application Integration on Google Cloud Platform in all versions prior to the 17 June 2026 fix, and the vendor's CVSS 4.0 vector of 9.4 reflects a genuine privilege-escalation and scope-crossing condition (SC/SI/SA:H) rather than simple data exposure. Google remediated the issue server-side on 17 June 2026 and states no customer action is required, meaning no current deployment remains exploitable; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Broken access control in Google Cloud Application Integration's QueryEngineTask lets an unauthenticated external attacker reach sensitive internal data across service versions released between 2025-04-28 and 2026-04-04. The flaw is a missing authorization check (CWE-862) on a task component of this managed iPaaS offering; Google reports it was fixed server-side on 2026-04-04 with no customer action required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor's CVSS 4.0 base score of 9.3 reflects the unauthenticated network reach.
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Arbitrary code execution in Google Cloud Application Integration affects service versions prior to 2026-09-11: an authenticated attacker (CVSS PR:L) can supply a maliciously crafted serialized object to the SubWorkflow task and execute arbitrary code. The issue carries a supplied CVSS score of 9.4 and the priority signal is act_now, but Google reports the defect was fixed server-side on 11 September 2026 with no customer action required. No public exploit is identified at time of analysis, and no CISA KEV entry is present in the supplied data.
Privilege escalation in Google Cloud Application Integration (versions prior to 2026-08-27) allows an authenticated low-privilege user within a Google Cloud project to abuse AuthConfig validation and the integration execution runtime to impersonate a higher-privileged service account and gain that account's cloud permissions. The flaw is classified as Incorrect Authorization (CWE-863) with a CVSS v4.0 base score of 7.3; there is no public exploit identified at time of analysis and no CISA KEV listing. Google remediated the issue server-side on 27 August 2026, so current Google Cloud instances are no longer affected and no customer patching action is required.
Authenticated Google Cloud users holding permission to configure Application Integration tasks could abuse an incorrectly authorized, internal-only task type to trigger arbitrary internal RPCs that executed inside Google's production network under a privileged Google identity. The flaw (CWE-863) affected Application Integration on Google Cloud Platform in all versions prior to the 17 June 2026 fix, and the vendor's CVSS 4.0 vector of 9.4 reflects a genuine privilege-escalation and scope-crossing condition (SC/SI/SA:H) rather than simple data exposure. Google remediated the issue server-side on 17 June 2026 and states no customer action is required, meaning no current deployment remains exploitable; no public exploit code has been identified at time of analysis, and CISA KEV does not list this issue.
Broken access control in Google Cloud Application Integration's QueryEngineTask lets an unauthenticated external attacker reach sensitive internal data across service versions released between 2025-04-28 and 2026-04-04. The flaw is a missing authorization check (CWE-862) on a task component of this managed iPaaS offering; Google reports it was fixed server-side on 2026-04-04 with no customer action required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor's CVSS 4.0 base score of 9.3 reflects the unauthenticated network reach.
Sandbox escape in the JavaScript Task feature of Google Cloud Application Integration allows an actor to execute arbitrary unsandboxed code via crafted JavaScript code executed by the Rhino engine. Rated critical severity (CVSS 9.4), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.