Google CloudCVE-2026-12879

Google Cloud Apigee: improper input validation

CVE-2026-12879 · Published Jul 9, 2026

Medium5.9

Fix: upgrade to 2026-06-12 or later

An Improper Input Validation vulnerability in BigQuery DAO in Google Cloud Apigee versions prior to 2026-06-12 on Google Cloud Platform allows an authenticated attacker to exfiltrate cross-tenant data.

This vulnerability was patched on 12 June 2026 on the Apigee Servers, and no customer action is needed.

Affected versions

Package	Affected	Fixed in
Apigee Product	< 2026-06-12	2026-06-12

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:H/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-441, CWE-610

More Google Cloud advisories

All Google Cloud

Critical 9.3Aug 22

Google Cloud Application Integration: missing authorizationCVE-2026-12710fixed in 2026-04-04 Critical 9.4Aug 17

Google SecOps (Chronicle SOAR): SQL injectionCVE-2026-15623fixed in 6.3.85 Critical 9.4Aug 5

Google SecOps (Chronicle SOAR): privilege escalationCVE-2026-15587fixed in 6.3.85 High 8.7Jul 24

Google Cloud Looker: cross-site scriptingCVE-2026-15810fixed in 25.6.103 +3 High 8.5Jul 17

Google Cloud Firebase Studio: missing authorizationCVE-2026-12715fixed in 2026-04-15 Critical 9.4Jul 13

Google Cloud BigQuery: missing authorizationCVE-2026-14934fixed in 2026-05-10 +2