Vulnerability · Published Jun 11, 2026 · Assigned by GoogleCloud
CVE-2026-4764Privilege Escalation in Dialogflow CX via Playbook Import
Critical 9.4
In plain English
A critical-severity missing authorization in Dialogflow CX from Google Cloud. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 11% of all known vulnerabilities).
Official description
A Missing Authorization vulnerability in the playbook import functionality in Dialogflow CX on Google Cloud Platform allows an authenticated user with specific roles to escalate privileges and potentially take over a GCP project using a maliciously crafted playbook import. This vulnerability was patched on 15 March 2026, and no customer action is needed.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Google Cloud | Dialogflow CX | 0 – before 2026-03-15 |
Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/U:Clear