CVE-2026-85298

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation in Google Cloud Application Integration

Publication date: 2026-10-14

Last updated on: 2026-10-16

Assigner: GoogleCloud

Description

An Incorrect Authorization vulnerability in the AuthConfig validation and integration execution runtime in Google Cloud Application Integration versions prior to 2026-08-27 allows an authenticated user to escalate privileges and impersonate a service account in the project. This vulnerability was patched on 27 August 2026, and no customer action is needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-14

Last Modified

2026-10-16

Generated

2026-10-19

AI Q&A

2026-10-15

EPSS Evaluated

2026-10-18

NVD

CVE-2026-85298

EUVD

EUVD-2026-101004

Affected Vendors & Products

Vendor	Product	Version / Range
Google	Cloud	Application Integration 0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This is an Incorrect Authorization vulnerability in Google Cloud Application Integration versions before 2026-08-27. It allows an authenticated user to escalate privileges and impersonate a service account within the project due to flawed validation in AuthConfig and integration execution runtime.

Detection Guidance

Detection requires checking the version of Google Cloud Application Integration. If your version is prior to 2026-08-27, the vulnerability may be present. No specific commands are provided in the context for detection.

Impact Analysis

An attacker could gain higher privileges than intended, potentially accessing sensitive data or performing unauthorized actions by impersonating a service account. This could lead to data breaches or service disruption if exploited.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR's data protection principles or HIPAA's security requirements. Compliance may be compromised if data is exposed or mishandled due to the flaw.

Mitigation Strategies

No action is required as this vulnerability was patched on 27 August 2026 and no customer action is needed.

Hi! I’m here to help you understand CVE-2026-85298. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70