CVE-2026-19759: CWE-863 Incorrect Authorization in Google Cloud Application Integration
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type. This vulnerability was patched on 17 June 2026, and no customer action is needed.
AI Analysis
Technical Summary
An Incorrect Authorization vulnerability (CWE-863) was discovered in the task configuration of Google Cloud Application Integration versions prior to 2026-06-17. Authenticated users could exploit an internal-only task type to execute arbitrary internal RPCs from inside Google's production network under a privileged identity. The vulnerability was addressed and patched by Google on June 17, 2026.
Potential Impact
An authenticated attacker could misuse internal-only task types to perform arbitrary internal RPC calls within Google's production environment with elevated privileges. This could lead to unauthorized actions within Google's internal systems. However, exploitation requires authentication and access to the affected service.
Mitigation Recommendations
This vulnerability has been officially patched by Google as of June 17, 2026. No customer action is required as the vendor manages remediation for this cloud-hosted service. Users should verify that their environments are updated to versions released on or after 2026-06-17.
CVE-2026-19759: CWE-863 Incorrect Authorization in Google Cloud Application Integration
Description
An Incorrect Authorization vulnerability in the task configuration in Google Cloud Application Integration versions prior to 2026-06-17 on Google Cloud Platform allows an authenticated Google Cloud user to execute arbitrary internal RPCs from inside Google's production network under a privileged identity using an internal-only task type. This vulnerability was patched on 17 June 2026, and no customer action is needed.
CVSS v4.0
Score 9.4critical
Affected software
Google Cloud
Application Integration
pkg:github/googlecloud/application-integrationRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
An Incorrect Authorization vulnerability (CWE-863) was discovered in the task configuration of Google Cloud Application Integration versions prior to 2026-06-17. Authenticated users could exploit an internal-only task type to execute arbitrary internal RPCs from inside Google's production network under a privileged identity. The vulnerability was addressed and patched by Google on June 17, 2026.
Potential Impact
An authenticated attacker could misuse internal-only task types to perform arbitrary internal RPC calls within Google's production environment with elevated privileges. This could lead to unauthorized actions within Google's internal systems. However, exploitation requires authentication and access to the affected service.
Mitigation Recommendations
This vulnerability has been officially patched by Google as of June 17, 2026. No customer action is required as the vendor manages remediation for this cloud-hosted service. Users should verify that their environments are updated to versions released on or after 2026-06-17.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GoogleCloud
- Date Reserved
- 2026-08-13T16:03:53.274Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Is Cloud Service
- true
- Vendor Advisory Urls
- [{"url":"https://docs.cloud.google.com/support/bulletins#gcp-2026-064","vendor":"Google"}]
Threat ID: 6aba45f9f7a7c541068c8d24
Added to database: 09/28/2026, 10:48:25 UTC
Last enriched: 09/28/2026, 11:02:43 UTC
Last updated: 09/29/2026, 02:50:01 UTC
Views: 29
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.