CVE-2026-85298
7.3HighPublished 14 Oct 2026 · NVD status: Awaiting Analysis · AI triage by gemini-3.8-flash
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
- Impact
- High impact on confidentiality
- Weakness
- CWE-863
Impact
Authenticated attackers can escalate privileges and impersonate project service accounts. They only need standard authenticated access to the project's Application Integration environment.
Root cause
Improper authorization checks in AuthConfig validation and the integration execution runtime allow unauthorized identity assumption.
Affected systems
Google Cloud Application Integration versions prior to 2026-08-27
CVSS v4.0 · CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Fix & remediation
No action required; Google patched the managed cloud service on 2026-08-27.
AI-suggested. Run it in staging first and check it against the vendor advisory. Why?
NVD description
An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.