Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
9.4
CVE-2026-19759: Google Cloud Application Integration may let users run internal tasks
CVE-2026-19759 · published 14 days ago
Summary
A flaw in older versions of Google Cloud Application Integration could let a logged‑in cloud user trigger internal commands that normally run with high privileges inside Google’s network. This could allow actions that should be restricted to system components. The issue was fixed on June 17, 2026, and no further steps are required by customers.
What to do
- Update google cloud application integration to version 2026-06-17 or later.
Affected software
| Vendor | Product | Affected versions |
|---|---|---|
| google cloud | application integration | < 2026-06-17 |
Original advisory text
Incorrect Authorization in Application Integration allows Internal Stubby RPC Execution
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type.
This vulnerability was patched on 17 June 2026, and no customer action is needed.
This vulnerability was patched on 17 June 2026, and no customer action is needed.
Internet-facing
14 days
Internal
At next upgrade
- Not known to be exploited
- Needs hands-on effort to exploit
- Gives an attacker full control
Type
CWE-863Incorrect Authorization
Timeline
Published28 Sep 2026
Updated7 Oct 2026
First seen28 Sep 2026
Track software like this
Free during beta