Compute Engine
Monthly
A missing authorization check in the Google Compute Engine disks.createSnapshot and regionDisks.createSnapshot APIs let an authenticated Cloud principal request a snapshot of a disk belonging to a different project, exposing cross-project disk data. Google remediated the flaw server-side on 31 August 2026 and states no customer action is needed, so current deployments are not exploitable; the exposure window is historical, covering Compute Engine use before that date. Confidentiality impact is high (disk contents could be read) but integrity and availability are unaffected, and no public exploit code or active exploitation has been identified at time of analysis, with an EPSS score of 0.35% (29th percentile).
A missing authorization check in the Google Compute Engine disks.createSnapshot and regionDisks.createSnapshot APIs let an authenticated Cloud principal request a snapshot of a disk belonging to a different project, exposing cross-project disk data. Google remediated the flaw server-side on 31 August 2026 and states no customer action is needed, so current deployments are not exploitable; the exposure window is historical, covering Compute Engine use before that date. Confidentiality impact is high (disk contents could be read) but integrity and availability are unaffected, and no public exploit code or active exploitation has been identified at time of analysis, with an EPSS score of 0.35% (29th percentile).