CVE-2026-19410
Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in Google Cloud Build GitHub Trigger Comment Control

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GoogleCloud

Description
An Incorrect Authorization vulnerability in GitHub Trigger Comment Control in Google Cloud Build prior to 2026-06-24 on Google Cloud Platform allows a remote attacker to execute unreviewed code in the build environment using webhook suppression. This vulnerability was patched on 24 June 2026, and no customer action is needed.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-31
Last Modified
2026-08-31
Generated
2026-09-20
AI Q&A
2026-08-31
EPSS Evaluated
2026-09-15
NVD
CVE-2026-19410
EUVD
EUVD-2026-68433

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
google cloud_build to 2026-06-24 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-345 The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.
CWE-367 The product checks the state of a resource before using that resource, but the resource's state can change between the check and the use in a way that invalidates the results of the check.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is an Incorrect Authorization issue in GitHub Trigger Comment Control within Google Cloud Build. It allows a remote attacker to bypass code review and execute unreviewed code in the build environment by suppressing webhooks. The flaw exists in versions prior to 2026-06-24 on Google Cloud Platform.

Impact Analysis

An attacker could exploit this to run malicious code in your build environment without proper review. This could lead to unauthorized changes, data breaches, or compromised deployments. However, the vulnerability was patched on 2026-06-24, and no customer action is required.

Compliance Impact

The vulnerability allows unauthorized code execution in the build environment, which could lead to data breaches or unauthorized access to sensitive data. This may impact compliance with GDPR (data protection) and HIPAA (healthcare data) by increasing the risk of unauthorized data exposure or processing.

Mitigation Strategies

No action is required as the vulnerability was patched on 24 June 2026 and no customer action is needed.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19410. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart