CVE-2026-19410: CWE-367 Time-of-check time-of-use (TOCTOU) race condition in Google Cloud Google Cloud Build
Description
CVE-2026-19410 is a critical time-of-check time-of-use (TOCTOU) race condition vulnerability in Google Cloud Build's GitHub Trigger Comment Control. It allows a remote attacker to execute unreviewed code in the build environment by exploiting webhook suppression. This vulnerability was patched by Google on June 24, 2026, and no customer action is required.
CVSS v4.0
Score 9.4critical
Affected software
Google Cloud
Google Cloud Build
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
This vulnerability involves an incorrect authorization issue in the GitHub Trigger Comment Control feature of Google Cloud Build prior to the patch date of 2026-06-24. The flaw is a TOCTOU race condition (CWE-367) that enables an attacker to bypass review controls and execute arbitrary code remotely in the build environment by suppressing webhooks. The vulnerability has a CVSS 4.0 score of 9.4, indicating critical severity. Google Cloud, as a cloud service provider, manages remediation server-side and has already patched the issue, eliminating the need for customer intervention.
Potential Impact
Successful exploitation allows remote attackers to execute unreviewed and potentially malicious code within the Google Cloud Build environment, posing a critical risk to the integrity and security of build processes. This could lead to unauthorized code execution and compromise of build artifacts or downstream deployments.
Mitigation Recommendations
The vulnerability was patched by Google on June 24, 2026. As this is a cloud-hosted service, Google manages the remediation server-side. Customers do not need to take any action.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GoogleCloud
- Date Reserved
- 2026-08-10T09:07:34.906Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
Threat ID: 6a954466acd9273b49d7ddd6
Added to database: 08/31/2026, 09:07:50 UTC
Last enriched: 09/07/2026, 15:57:29 UTC
Last updated: 10/13/2026, 18:48:18 UTC
Views: 123
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.