Vulnerability · Published Jul 13, 2026 · Assigned by GoogleCloud
CVE-2026-14934Cross-Tenant Repository Takeover via Improper Access Control in BigQuery, Dataform and Colab Enterprise
Critical 9.4
In plain English
A critical-severity missing authorization in BigQuery from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A Missing Authorization vulnerability in the repository creation functionality in Google Cloud BigQuery, Dataform and Colab Enterprise, in the versions between October 2025 and May 10th, 2026, on Google Cloud Platform, allows an authenticated attacker to escalate privileges and perform cross-tenant repository takeover. This vulnerability was patched on 10 May 2026, and no customer action is needed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | BigQuery | 2025-10 – before 2026-05-10 |
| Google Cloud | Dataform | 2025-10 – before 2026-05-10 |
| Google Cloud | Colab Enterprise | 2025-10 – before 2026-05-10 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear