Vulnerability · Published May 15, 2026 · Assigned by GoogleCloud
CVE-2026-2031Google Cloud Application Integration: Exposed internal APIs allow Information Disclosure and Remote Code Execution.
Critical 10.0
In plain English
A critical-severity missing authorization in Internal Integration Platform APIs from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 45% of all known vulnerabilities).
Official description
An Improper Access Control vulnerability in several internal API endpoints for Google Cloud Application Integration prior to 2026-01-23 allows a remote, unauthenticated attacker to disclose sensitive internal information and execute arbitrary code using specially crafted HTTP requests to inadvertently exposed internal API endpoints.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | Internal Integration Platform APIs | 0 – before 2026-01-23 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear