Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.9

Google Cloud Console App Engine Log Exposure via GraphQL API

CVE-2026-8934 · published 4 months ago
Summary

An attacker could access sensitive logs from other projects without permission. This issue affected the Google Cloud Console's App Engine section, but it's now fixed and no action is needed from users. The vulnerability was patched on April 7, 2026.

Original advisory text
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine...
A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request.

This vulnerability was patched on 7 April 2026, and no customer action is needed.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker partial control
Severity
6.9 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-862Missing Authorization
Timeline
Published22 Jun 2026
Updated4 Nov 2026
First seen22 Jun 2026
Sources
CVE-2026-8934 · NVD
Track software like this
Free during beta