Vulnerability · Published Sep 4, 2026 · Assigned by GoogleCloud
CVE-2026-4644Improper Authorization in Google Cloud Integration Connectors Leads to Project Takeover
High 8.5
In plain English
A high-severity incorrect authorization in Integration Connectors from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 29% of all known vulnerabilities).
Official description
A Missing Authorization vulnerability in HTTP Connector in Google Cloud Integration Connectors versions prior to 2025-12-11 on Google Cloud Platform allows an authenticated user to escalate privileges and take over a Google Cloud Project using unauthorized service account attachment. This vulnerability was patched on 11 December 2025, and no customer action is needed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | Integration Connectors | 0 – before 2025-12-11 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:H/SI:H/SA:H/U:Clear