Vulnerability · Published Mar 3, 2026 · Assigned by GoogleCloud
CVE-2026-3136Google Cloud Build Comment Control Bypass
High 8.6
In plain English
A high-severity incorrect authorization in Cloud Build from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 33% of all known vulnerabilities).
Severity (CVSS 4.0)8.6High
Exploit odds (30 days)0.4%top 66.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
An improper authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-1-26 allows a remote attacker to execute arbitrary code in the build environment. This vulnerability was patched on 26 January 2026, and no customer action is needed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | Cloud Build | 0 – before 1/26/2026 |
Weakness: CWE-863 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:L/SI:L/SA:L/U:Clear