Google Cloud
Monthly
Arbitrary code execution in Google Cloud's Gemini CLI (npm @google/gemini-cli < 0.39.1) and the run-gemini-cli GitHub Action (< 0.1.22) lets an unprivileged attacker run code on the host by planting untrusted local .env / .gemini configuration files that override GEMINI_CLI_HOME. In headless (CI) mode, previous versions auto-trusted workspace folders and processed their config/environment variables, so a malicious pull request or issue processed by an automated Gemini workflow could trigger RCE; a related --yolo tool-allowlist bypass compounds the risk. Patched by vendor; no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.
Privilege escalation in Google Cloud Integration Connectors (HTTP Connector component) allows an authenticated low-privilege user to attach an unauthorized service account to a connector, effectively taking over the associated Google Cloud Project. Affected versions are those deployed prior to the 2025-12-11 server-side patch, which Google applied automatically with no customer action required. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector reflects high subsequent-system impact across confidentiality, integrity, and availability - matching a full project compromise scenario.
Path traversal in Google Cloud Agent Development Kit (ADK) Python versions 1.9.0 through 1.21.0 exposes arbitrary server files to unauthenticated remote attackers via a crafted `file_path` query parameter on the builder endpoint. The root cause, confirmed by the upstream commit diff, is that `fast_api.py` passed the user-supplied path directly into filesystem operations without sanitization or boundary enforcement, allowing `../` sequences to escape the agents directory. No public exploit code or active exploitation has been identified; vendor-released fix is available in v1.22.0.
Unreviewed code execution in Google Cloud Build (GitHub-triggered builds prior to the 2026-06-24 fix) allowed a remote attacker to bypass the GitHub Trigger Comment Control approval gate via webhook suppression and run attacker-supplied code inside the build environment. The Comment Control feature is meant to require a maintainer's approval comment before a pull request from an outside contributor triggers a build; the flaw let that check be evaded so unapproved code executed. No public exploit identified at time of analysis, and Google states the issue was patched server-side with no customer action required.
Cross-tenant data exposure in Google Cloud Vertex AI Search for Commerce (versions prior to 2026-04-27) allowed an authenticated attacker who knew a victim's Google Cloud project number to read from and write to the Cloud Storage buckets used for BigQuery Import staging, because those bucket names were predictably derived rather than randomized. An attacker could reach another tenant's staged catalog data and import error logs, breaching data confidentiality and integrity across project boundaries. There is no public exploit identified at time of analysis, and Google fixed the issue server-side so no customer action is required.
Remote code execution in Google Cloud BigQuery Data Transfer Service (versions prior to the 2026-05-01 service release) allows an authenticated tenant user to run arbitrary code inside the managed connector container and escalate privileges within the tenant project by supplying crafted parameters in a JDBC connection string routed through the bundled CData JDBC driver. Rated CVSS 4.0 9.4 (Critical) with a scope change to subsequent systems, the flaw was fixed server-side by Google on 1 May 2026 and requires no customer action. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broken access control in Google Cloud Application Integration's QueryEngineTask lets an unauthenticated external attacker reach sensitive internal data across service versions released between 2025-04-28 and 2026-04-04. The flaw is a missing authorization check (CWE-862) on a task component of this managed iPaaS offering; Google reports it was fixed server-side on 2026-04-04 with no customer action required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor's CVSS 4.0 base score of 9.3 reflects the unauthenticated network reach.
Blind SQL injection in Google SecOps (Chronicle SOAR) versions before 6.3.85 lets an authenticated user abuse a crafted request parameter in a legacy dashboard widget API to run arbitrary blind SQL queries against the backend database. CVSS 4.0 rates it 9.4 (critical) with a low-privilege network vector; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Because the platform is a Google Cloud-managed SaaS, the fix was deployed by the vendor and no customer action is required.
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.
We need to produce a JSON with the fields as specified. The input data includes description, CVSS vector (CVSS 4.0), CWE, EPSS, SSVC, patch info, CPE, tags, references, etc. The output must be a JSON object. Let's analyze the data: - CVE-2026-15810: XSS in Google Cloud Looker (formerly Looker) versions prior to several patched versions. Allows arbitrary JavaScript execution leading to administrative account takeover via malicious URL. Looker-hosted and Self-hosted. Hosted already mitigated. Self-hosted must upgrade. - CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber - AV:N network, AC:L low, AT:N none, PR:N none, UI:P passive (user interaction required), VC:H/VI:H/VA:H (high impact on vulnerable system integrity, confidentiality, availability), SC:L/SI:L/SA:L (low impact on subsequent system). Overall base score 8.7? Actually the vector doesn't include score, but we are given "CVSS Score: 8.7" and vector. So CVSS 4.0 base score 8.7. However, the output requires "assessed_cvss_vector" (CVSS 3.1) and "assessed_cvss40_vector". The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." And also "assessed_cvss40_vector" "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So we need to provide a 3.1 vector, and then a 4.0 vector based on our assessment. But we also have the input's CVSS 4.0 vector. We can use that to derive our own. It's an XSS with high impact: admin account takeover. User interaction required (UI:P in CVSS 4.0 means passive user interaction, so in 3.1, UI:R). No privileges required (PR:N). Network attack vector. So for 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H? Actually XSS typically scope changed? In CVSS 3.1, XSS usually has scope changed
Cross-tenant data disclosure in Google Cloud Firebase Studio (versions prior to the 2026-04-15 fix) let an authenticated user retrieve other tenants' deployed source code and sensitive data by issuing unauthorized GCS signed-URL requests. The flaw stems from a missing authorization check (CWE-862) on the object-signing path rather than a code-execution bug, so impact is confidentiality-centric. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-tenant privilege escalation in the repository creation functionality shared by Google Cloud BigQuery, Dataform, and Colab Enterprise allowed an authenticated GCP user to take over repositories belonging to other tenants. Rated CVSS 4.0 9.4 (critical) with a scope-changing cross-tenant impact, the flaw was a Missing Authorization (CWE-862) issue affecting the managed services between October 2025 and 10 May 2026. Google reports no public exploit identified at time of analysis; the defect was fixed server-side on 10 May 2026 with no customer action required.
Pre-sandbox host-level code execution in Google Gemini CLI (versions prior to 0.39.1) and the run-gemini-cli GitHub Action (prior to 0.1.22) allows an unprivileged attacker to run arbitrary commands on CI/CD runner hosts by planting a malicious .gemini/.env file in an untrusted workspace. In headless mode the tool automatically trusted workspace folders and loaded their environment variables before sandboxing, so a workflow that processes attacker-controlled content (for example reviewing a submitted pull request) would execute attacker-supplied commands on the host. No public exploit has been identified at time of analysis, but Google rates this CVSS 4.0 10.0 and a vendor advisory (GHSA-wpqr-6v78-jr5g) with fixed releases is available.
Privilege escalation in Google Cloud Dialogflow CX allows authenticated users holding specific IAM roles to abuse the playbook import functionality and potentially take over the entire GCP project. Google has confirmed the issue was patched server-side on 15 March 2026 with no customer action required, and no public exploit has been identified at time of analysis.
Server-Side Request Forgery in Google Cloud Apigee-X's SetIntegrationRequest policy enables remote attackers to coerce the API gateway into making attacker-controlled requests and exfiltrate service account access tokens from the underlying GCP metadata service. The flaw affects Apigee-X versions prior to 1.14.4, 1.15.2, and 1.16.1, but exploitation requires an administrator to have first deployed an API proxy with an insecure configuration. With no public exploit identified and a low EPSS score of 0.14%, the issue carries CVSS 9.2 severity primarily due to the high confidentiality and integrity impact on cloud credentials.
Remote code execution in Google Cloud Application Integration allows unauthenticated attackers to access exposed internal API endpoints and execute arbitrary code. The vulnerability stems from improper access controls on internal APIs that were inadvertently exposed to external networks. With a CVSS 4.0 score of 10.0, this represents a critical risk allowing both information disclosure and full system compromise without authentication.
Full administrative database takeover in Google Cloud AlloyDB for PostgreSQL affected clusters provisioned via Terraform or the REST API before 2025-11-03, where those provisioning paths applied an insecure default password. A remote attacker with network reachability to such a cluster could authenticate as a privileged account and gain complete control of the database. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%, 12th percentile), consistent with the SSVC assessment of no observed exploitation.
Information disclosure in Google BigQuery materialized view refresh allows authenticated users to extract sensitive data via crafted views that generate error messages containing confidential information. Google Cloud Platform patched this server-side vulnerability on 29 January 2026 with automatic remediation requiring no customer action. The CVSS 4.0 score of 7.1 reflects high confidentiality impact with network-accessible attack vector and low attack complexity, though no public exploit or CISA KEV listing exists at time of analysis.
Remote code execution in Google Agent Development Kit (ADK) versions 1.7.0-1.28.0 and 2.0.0a1 allows unauthenticated remote attackers to execute arbitrary code on ADK server instances via combined code injection and missing authentication flaws. Affects Python OSS deployments, Cloud Run, and GKE environments. CVSS 9.3 critical severity with proof-of-concept code available (CVSS:4.0 E:P). No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis, though the authentication bypass combined with RCE presents extreme risk for exposed instances.
Cross-tenant data exfiltration in Google Cloud Apigee (versions prior to 2026-06-12) is possible via improper input validation in the BigQuery Data Access Object (DAO) component. An authenticated attacker with high-privilege access can craft requests that bypass tenant isolation boundaries, accessing confidential data belonging to other Apigee tenants on Google Cloud Platform. Google patched this server-side on June 12, 2026 with no customer action required; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-project App Engine request log leakage in Google Cloud Console's GraphQL private API exposed sensitive telemetry data to unauthenticated remote attackers. The vulnerability, classified as CWE-862 (Missing Authorization), allowed a specially crafted GraphQL request to bypass authorization controls on the App Engine section of Cloud Console, enabling read access to request logs belonging to arbitrary GCP projects. Google applied a server-side fix on 7 April 2026; no public exploit or KEV listing has been identified at time of analysis.
Arbitrary code execution in Google Cloud's Gemini CLI (npm @google/gemini-cli < 0.39.1) and the run-gemini-cli GitHub Action (< 0.1.22) lets an unprivileged attacker run code on the host by planting untrusted local .env / .gemini configuration files that override GEMINI_CLI_HOME. In headless (CI) mode, previous versions auto-trusted workspace folders and processed their config/environment variables, so a malicious pull request or issue processed by an automated Gemini workflow could trigger RCE; a related --yolo tool-allowlist bypass compounds the risk. Patched by vendor; no public exploit identified at time of analysis and it is not in CISA KEV.
Remote code execution in Google Cloud Agent Development Kit (ADK) for Python versions 2.0.0 through 2.6.0 allows an unauthenticated remote attacker to run arbitrary code on the host by submitting a crafted test session replay to the 'adk web' developer interface when the pytest package is present. The flaw stems from an incomplete input-restriction check (CWE-184) that lets malicious replay content reach code execution. No public exploit has been identified at time of analysis, but the vendor rates it CVSS 10.0 and shipped a fix in v2.7.0.
Privilege escalation in Google Cloud Integration Connectors (HTTP Connector component) allows an authenticated low-privilege user to attach an unauthorized service account to a connector, effectively taking over the associated Google Cloud Project. Affected versions are those deployed prior to the 2025-12-11 server-side patch, which Google applied automatically with no customer action required. No public exploit has been identified at time of analysis, but the CVSS 4.0 vector reflects high subsequent-system impact across confidentiality, integrity, and availability - matching a full project compromise scenario.
Path traversal in Google Cloud Agent Development Kit (ADK) Python versions 1.9.0 through 1.21.0 exposes arbitrary server files to unauthenticated remote attackers via a crafted `file_path` query parameter on the builder endpoint. The root cause, confirmed by the upstream commit diff, is that `fast_api.py` passed the user-supplied path directly into filesystem operations without sanitization or boundary enforcement, allowing `../` sequences to escape the agents directory. No public exploit code or active exploitation has been identified; vendor-released fix is available in v1.22.0.
Unreviewed code execution in Google Cloud Build (GitHub-triggered builds prior to the 2026-06-24 fix) allowed a remote attacker to bypass the GitHub Trigger Comment Control approval gate via webhook suppression and run attacker-supplied code inside the build environment. The Comment Control feature is meant to require a maintainer's approval comment before a pull request from an outside contributor triggers a build; the flaw let that check be evaded so unapproved code executed. No public exploit identified at time of analysis, and Google states the issue was patched server-side with no customer action required.
Cross-tenant data exposure in Google Cloud Vertex AI Search for Commerce (versions prior to 2026-04-27) allowed an authenticated attacker who knew a victim's Google Cloud project number to read from and write to the Cloud Storage buckets used for BigQuery Import staging, because those bucket names were predictably derived rather than randomized. An attacker could reach another tenant's staged catalog data and import error logs, breaching data confidentiality and integrity across project boundaries. There is no public exploit identified at time of analysis, and Google fixed the issue server-side so no customer action is required.
Remote code execution in Google Cloud BigQuery Data Transfer Service (versions prior to the 2026-05-01 service release) allows an authenticated tenant user to run arbitrary code inside the managed connector container and escalate privileges within the tenant project by supplying crafted parameters in a JDBC connection string routed through the bundled CData JDBC driver. Rated CVSS 4.0 9.4 (Critical) with a scope change to subsequent systems, the flaw was fixed server-side by Google on 1 May 2026 and requires no customer action. There is no public exploit identified at time of analysis, and it is not listed in CISA KEV.
Broken access control in Google Cloud Application Integration's QueryEngineTask lets an unauthenticated external attacker reach sensitive internal data across service versions released between 2025-04-28 and 2026-04-04. The flaw is a missing authorization check (CWE-862) on a task component of this managed iPaaS offering; Google reports it was fixed server-side on 2026-04-04 with no customer action required. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the vendor's CVSS 4.0 base score of 9.3 reflects the unauthenticated network reach.
Blind SQL injection in Google SecOps (Chronicle SOAR) versions before 6.3.85 lets an authenticated user abuse a crafted request parameter in a legacy dashboard widget API to run arbitrary blind SQL queries against the backend database. CVSS 4.0 rates it 9.4 (critical) with a low-privilege network vector; no public exploit is identified at time of analysis and it is not listed in CISA KEV. Because the platform is a Google Cloud-managed SaaS, the fix was deployed by the vendor and no customer action is required.
Privilege escalation in Google SecOps (Chronicle SOAR) versions prior to 6.3.85 on Google Cloud Platform allows an authenticated attacker to forge a crafted internal authentication header and elevate from a low-privileged account to system-level administrative access. The flaw stems from improper validation of the origin/trust of an internal auth header (CWE-346), and carries a critical CVSS 4.0 base score of 9.4 driven by high confidentiality, integrity, and availability impact plus a scope change onto subsequent systems. There is no public exploit identified at time of analysis; Google patched the cloud-hosted service transparently and states no customer action is needed.
We need to produce a JSON with the fields as specified. The input data includes description, CVSS vector (CVSS 4.0), CWE, EPSS, SSVC, patch info, CPE, tags, references, etc. The output must be a JSON object. Let's analyze the data: - CVE-2026-15810: XSS in Google Cloud Looker (formerly Looker) versions prior to several patched versions. Allows arbitrary JavaScript execution leading to administrative account takeover via malicious URL. Looker-hosted and Self-hosted. Hosted already mitigated. Self-hosted must upgrade. - CVSS 4.0 vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber - AV:N network, AC:L low, AT:N none, PR:N none, UI:P passive (user interaction required), VC:H/VI:H/VA:H (high impact on vulnerable system integrity, confidentiality, availability), SC:L/SI:L/SA:L (low impact on subsequent system). Overall base score 8.7? Actually the vector doesn't include score, but we are given "CVSS Score: 8.7" and vector. So CVSS 4.0 base score 8.7. However, the output requires "assessed_cvss_vector" (CVSS 3.1) and "assessed_cvss40_vector". The instruction: "Your OWN independent CVSS 3.1 base-metric vector for THIS vulnerability, grounded in the description and exploitation conditions — NOT a copy of any score in the input." And also "assessed_cvss40_vector" "The SAME assessment expressed as a CVSS 4.0 base vector, consistent with your 3.1 choice." So we need to provide a 3.1 vector, and then a 4.0 vector based on our assessment. But we also have the input's CVSS 4.0 vector. We can use that to derive our own. It's an XSS with high impact: admin account takeover. User interaction required (UI:P in CVSS 4.0 means passive user interaction, so in 3.1, UI:R). No privileges required (PR:N). Network attack vector. So for 3.1: AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H? Actually XSS typically scope changed? In CVSS 3.1, XSS usually has scope changed
Cross-tenant data disclosure in Google Cloud Firebase Studio (versions prior to the 2026-04-15 fix) let an authenticated user retrieve other tenants' deployed source code and sensitive data by issuing unauthorized GCS signed-URL requests. The flaw stems from a missing authorization check (CWE-862) on the object-signing path rather than a code-execution bug, so impact is confidentiality-centric. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Cross-tenant privilege escalation in the repository creation functionality shared by Google Cloud BigQuery, Dataform, and Colab Enterprise allowed an authenticated GCP user to take over repositories belonging to other tenants. Rated CVSS 4.0 9.4 (critical) with a scope-changing cross-tenant impact, the flaw was a Missing Authorization (CWE-862) issue affecting the managed services between October 2025 and 10 May 2026. Google reports no public exploit identified at time of analysis; the defect was fixed server-side on 10 May 2026 with no customer action required.
Pre-sandbox host-level code execution in Google Gemini CLI (versions prior to 0.39.1) and the run-gemini-cli GitHub Action (prior to 0.1.22) allows an unprivileged attacker to run arbitrary commands on CI/CD runner hosts by planting a malicious .gemini/.env file in an untrusted workspace. In headless mode the tool automatically trusted workspace folders and loaded their environment variables before sandboxing, so a workflow that processes attacker-controlled content (for example reviewing a submitted pull request) would execute attacker-supplied commands on the host. No public exploit has been identified at time of analysis, but Google rates this CVSS 4.0 10.0 and a vendor advisory (GHSA-wpqr-6v78-jr5g) with fixed releases is available.
Privilege escalation in Google Cloud Dialogflow CX allows authenticated users holding specific IAM roles to abuse the playbook import functionality and potentially take over the entire GCP project. Google has confirmed the issue was patched server-side on 15 March 2026 with no customer action required, and no public exploit has been identified at time of analysis.
Server-Side Request Forgery in Google Cloud Apigee-X's SetIntegrationRequest policy enables remote attackers to coerce the API gateway into making attacker-controlled requests and exfiltrate service account access tokens from the underlying GCP metadata service. The flaw affects Apigee-X versions prior to 1.14.4, 1.15.2, and 1.16.1, but exploitation requires an administrator to have first deployed an API proxy with an insecure configuration. With no public exploit identified and a low EPSS score of 0.14%, the issue carries CVSS 9.2 severity primarily due to the high confidentiality and integrity impact on cloud credentials.
Remote code execution in Google Cloud Application Integration allows unauthenticated attackers to access exposed internal API endpoints and execute arbitrary code. The vulnerability stems from improper access controls on internal APIs that were inadvertently exposed to external networks. With a CVSS 4.0 score of 10.0, this represents a critical risk allowing both information disclosure and full system compromise without authentication.
Full administrative database takeover in Google Cloud AlloyDB for PostgreSQL affected clusters provisioned via Terraform or the REST API before 2025-11-03, where those provisioning paths applied an insecure default password. A remote attacker with network reachability to such a cluster could authenticate as a privileged account and gain complete control of the database. There is no public exploit identified at time of analysis, and the EPSS probability is very low (0.04%, 12th percentile), consistent with the SSVC assessment of no observed exploitation.
Information disclosure in Google BigQuery materialized view refresh allows authenticated users to extract sensitive data via crafted views that generate error messages containing confidential information. Google Cloud Platform patched this server-side vulnerability on 29 January 2026 with automatic remediation requiring no customer action. The CVSS 4.0 score of 7.1 reflects high confidentiality impact with network-accessible attack vector and low attack complexity, though no public exploit or CISA KEV listing exists at time of analysis.
Remote code execution in Google Agent Development Kit (ADK) versions 1.7.0-1.28.0 and 2.0.0a1 allows unauthenticated remote attackers to execute arbitrary code on ADK server instances via combined code injection and missing authentication flaws. Affects Python OSS deployments, Cloud Run, and GKE environments. CVSS 9.3 critical severity with proof-of-concept code available (CVSS:4.0 E:P). No CISA KEV listing indicates no confirmed widespread exploitation at time of analysis, though the authentication bypass combined with RCE presents extreme risk for exposed instances.
Cross-tenant data exfiltration in Google Cloud Apigee (versions prior to 2026-06-12) is possible via improper input validation in the BigQuery Data Access Object (DAO) component. An authenticated attacker with high-privilege access can craft requests that bypass tenant isolation boundaries, accessing confidential data belonging to other Apigee tenants on Google Cloud Platform. Google patched this server-side on June 12, 2026 with no customer action required; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-project App Engine request log leakage in Google Cloud Console's GraphQL private API exposed sensitive telemetry data to unauthenticated remote attackers. The vulnerability, classified as CWE-862 (Missing Authorization), allowed a specially crafted GraphQL request to bypass authorization controls on the App Engine section of Cloud Console, enabling read access to request logs belonging to arbitrary GCP projects. Google applied a server-side fix on 7 April 2026; no public exploit or KEV listing has been identified at time of analysis.