Vulnerability · Published Aug 31, 2026 · Assigned by GoogleCloud

CVE-2026-19410Google Cloud Build Comment Control Bypass via Webhook Suppression

Critical 9.4

In plain English

A critical-severity insufficient verification of data authenticity in Google Cloud Build from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 10% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical

Exploit odds (30 days)0.2%top 90.5% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack toolingNoneno public tooling known

Official description

An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and no customer action is needed.

Affected products (as reported)

Vendor	Product	Versions
Google Cloud	Google Cloud Build	0 – before 2026-06-24

Weakness: CWE-367, CWE-345 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear

References

https://docs.cloud.google.com/build/docs/release-notes#August_24_2026