Google CloudCVE-2026-19410

Google Cloud Build: improper authorization

Critical9.4CVE-2026-19410 · Published Aug 31, 2026

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and no customer action is needed.

Google Cloud advisory

Affected versions

Package	Affected	Fixed in
Google Cloud Build Product	< 2026-06-24	2026-06-24

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-345, CWE-367

More Google Cloud advisories

All Google Cloud

Date	Advisory	Severity	Fixed in
Sep 9	Google Cloud Agent Development Kit (ADK) for Python: code injection Critical10.0Sep 9 CVE-2026-796962.7.0	Critical10.0	2.7.0
Sep 4	Google Cloud Agent Development Kit (ADK): path traversal High8.7Sep 4 CVE-2026-797071.22.0	High8.7	1.22.0
Sep 4	Google Cloud Integration Connectors: missing authorization High8.5Sep 4 CVE-2026-46442025-12-11	High8.5	2025-12-11
Aug 26	Google Cloud Vertex AI Search for Commerce: weak randomness Critical9.3Aug 26 CVE-2026-194852026-04-27	Critical9.3	2026-04-27
Aug 26	Google Cloud BigQuery Data Transfer Service: improper input validation Critical9.4Aug 26 CVE-2026-127172026-05-01	Critical9.4	2026-05-01
Aug 22	Google Cloud Application Integration: missing authorization Critical9.3Aug 22 CVE-2026-127102026-04-04	Critical9.3	2026-04-04

Affected versions

More Google Cloud advisories

Critical advisories by email