CVE-2026-8934

A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request. This vulnerability was patched on 7 April 2026, and no customer action is needed.

CVSS

No CVSS.

References

Link	Resource
https://docs.cloud.google.com/support/bulletins#gcp-2026-038

Configurations

No configuration.

History

25 Oct 2026, 23:10

Type	Values Removed	Values Added
Summary		(es) Una vulnerabilidad de falta de autorización en una operación de API privada de GraphQL de la sección de Google App Engine de Cloud Console permite a un atacante remoto no autenticado filtrar registros de solicitudes sensibles de App Engine de otros proyectos utilizando una solicitud especialmente diseñada. Esta vulnerabilidad fue parcheada el 7 de abril de 2026, y no se requiere ninguna acción por parte del cliente.

Information

Published : 2026-06-22 16:16

Updated : 2026-10-25 23:10

NVD link : CVE-2026-8934

Mitre link : CVE-2026-8934

CVE.ORG link : CVE-2026-8934

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-8934", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8934", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-06-22T16:28:53.118692Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Clear", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "CLEAR", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "affectedData": [{"vendor": "Google Cloud", "product": "Cloud Console UIs", "versions": [{"status": "affected", "version": "0", "lessThan": "2026-04-07", "versionType": "date"}], "defaultStatus": "unaffected"}]}], "published": "2026-06-22T16:16:43.097", "references": [{"url": "https://docs.cloud.google.com/support/bulletins#gcp-2026-038", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}], "vulnStatus": "Awaiting Analysis", "weaknesses": [{"type": "Secondary", "source": "f45cbf4e-4146-4068-b7e1-655ffc2c548c", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "A Missing Authorization vulnerability in a GraphQL private API operation of the Google App Engine section of the Cloud Console allows an unauthenticated remote attacker to leak sensitive App Engine request logs from other projects using a specially crafted request.\n\nThis vulnerability was patched on 7 April 2026, and no customer action is needed."}, {"lang": "es", "value": "Una vulnerabilidad de falta de autorizaci\u00f3n en una operaci\u00f3n de API privada de GraphQL de la secci\u00f3n de Google App Engine de Cloud Console permite a un atacante remoto no autenticado filtrar registros de solicitudes sensibles de App Engine de otros proyectos utilizando una solicitud especialmente dise\u00f1ada.\n\nEsta vulnerabilidad fue parcheada el 7 de abril de 2026, y no se requiere ninguna acci\u00f3n por parte del cliente."}], "lastModified": "2026-10-25T23:10:00.167", "sourceIdentifier": "f45cbf4e-4146-4068-b7e1-655ffc2c548c"}