Google CloudCVE-2026-19410

Google Cloud Build: improper authorization

CVE-2026-19410 · Published Aug 31, 2026

Critical9.4

Fix: upgrade to 2026-06-24 or later

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression.

This vulnerability was patched on 24 June 2026, and no customer action is needed.

Affected versions

Package	Affected	Fixed in
Google Cloud Build Product	< 2026-06-24	2026-06-24

Details and references

CVSS 4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear
Severity from: the vendor (its own CVE record or advisory)
Weakness: CWE-345, CWE-367

More Google Cloud advisories

All Google Cloud

Critical 10.0Sep 9

Google Cloud Agent Development Kit (ADK) for Python: code injectionCVE-2026-79696fixed in 2.7.0 High 8.7Sep 4

Google Cloud Agent Development Kit (ADK): path traversalCVE-2026-79707fixed in 1.22.0 High 8.5Sep 4

Google Cloud Integration Connectors: missing authorizationCVE-2026-4644fixed in 2025-12-11 Critical 9.3Aug 26

Google Cloud Vertex AI Search for Commerce: weak randomnessCVE-2026-19485fixed in 2026-04-27 Critical 9.4Aug 26

Google Cloud BigQuery Data Transfer Service: improper input validationCVE-2026-12717fixed in 2026-05-01 Critical 9.3Aug 22

Google Cloud Application Integration: missing authorizationCVE-2026-12710fixed in 2026-04-04